Make Cartfile optional if Cartfile.private exists

Fixes #254 
Can we start returning a `ColdSignal` from this method instead? Blocking methods like `single()` are bad form.