Make Cartfile optional if Cartfile.private exists

Fixes #254 
Maybe? We seem to want that everywhere in the current implementation.

As long as we document the behavior, I think either is fine.