chore(deps): drop @byteslice/result 0.3.0 bump, fix zod 3.25 API

The dependabot group included @byteslice/result 0.2 → 0.3, which is a
breaking change despite the 0.x semver (FailureOption was tightened to
require Error shape, breaking every Result<T, ProtectError> site across
protect and stack packages). Revert to ^0.2.0 and ignore future bumps
in dependabot.yml until a major-version migration is done.

zod 3.25 dropped the experimental `error:` create-param; switch the
cli config schema to the canonical `required_error:`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: auxesis

.github/dependabot.yml

@@ -37,6 +37,9 @@ updates:
     ignore:
       # Catalog-managed; bump manually via pnpm-workspace.yaml + changeset.
       - dependency-name: "@cipherstash/auth"
+      # 0.x bumps ship breaking type changes (e.g. 0.2 → 0.3 tightened the
+      # FailureOption constraint). Review and apply manually.
+      - dependency-name: "@byteslice/result"
       # Major bumps are reviewed and applied manually, not by Dependabot.
       - dependency-name: "*"
         update-types:

packages/cli/src/config/index.ts

@@ -43,7 +43,7 @@ const DEFAULT_ENCRYPT_CLIENT_PATH = './src/encryption/index.ts'
 
 const stashConfigSchema = z.object({
   databaseUrl: z
-    .string({ error: 'databaseUrl is required' })
+    .string({ required_error: 'databaseUrl is required' })
     .min(1, 'databaseUrl must not be empty'),
   client: z.string().default(DEFAULT_ENCRYPT_CLIENT_PATH),
 })

packages/protect-dynamodb/package.json

@@ -48,6 +48,6 @@
 		"access": "public"
 	},
 	"dependencies": {
-		"@byteslice/result": "^0.3.0"
+		"@byteslice/result": "^0.2.0"
 	}
 }

packages/protect/package.json

@@ -68,7 +68,7 @@
 		"access": "public"
 	},
 	"dependencies": {
-		"@byteslice/result": "^0.3.0",
+		"@byteslice/result": "^0.2.0",
 		"@cipherstash/protect-ffi": "0.21.4",
 		"@cipherstash/schema": "workspace:*",
 		"@stricli/core": "^1.2.7",

packages/stack/package.json

@@ -202,7 +202,7 @@
 		"access": "public"
 	},
 	"dependencies": {
-		"@byteslice/result": "0.3.0",
+		"@byteslice/result": "0.2.0",
 		"@cipherstash/protect-ffi": "0.21.4",
 		"evlog": "1.11.0",
 		"uuid": "14.0.0",