v0.3.4 — cross-platform path fix + CI and OIDC publishing

v0.3.4

Fix (affects Linux/macOS users): resolveHandoverPath() decided "is this an absolute path?"
with the platform-dependent path.isAbsolute(). On Linux, D:\other\H.md is not absolute, so it
was joined onto the session working directory and became D:\proj/D:\other\H.md — a path that
exists nowhere. The inverse was broken too (on Windows, /home/x/H.md). It now recognises three
root forms explicitly — the platform's own, a drive letter or UNC (C:\x, \\srv\share), and a
leading POSIX slash — with six regression assertions.

Engineering (transparent to users, but it makes the package more trustworthy): the repository
now runs GitHub Actions on every push (unit tests + byte-identical client-bundle check + a package
contents guard, on both Node 22.19 and 24), and publishing moved to npm Trusted Publishing
(OIDC) — no long-lived local token, and released artifacts carry a provenance attestation.

Feature-wise identical to v0.3.3: bilingual (zh/en) runtime copy, session-header badge, the
two-threshold reminder at 45% / 60%, the zero-LLM handoff draft from 45%, the host state route
GET /api/context-guard/state, the optional WeChat push (off by default), and the hardened
file-write path. Context tax is zero: no model-facing tool, no injected prompt section.

中文

v0.3.4

修复（Linux/macOS 用户会受影响）：resolveHandoverPath() 用平台相关的 path.isAbsolute()
判断「是不是绝对路径」。在 Linux 上 D:\other\H.md 不是绝对路径，于是被拼到会话工作目录后面，
变成 D:\proj/D:\other\H.md —— 一个在任何平台上都不存在的路径。反方向（Windows 上的
/home/x/H.md）同样是错的。现在显式认三种「自带根」形态：本平台绝对路径 / 盘符或 UNC
（C:\x、\\srv\share）/ POSIX 斜杠开头，并加了 6 条回归断言。

工程侧（对使用者透明，但让这个包更可信）：仓库接入 GitHub Actions，每次推送都跑
（单测 + client bundle 逐字节同源 + 包内容守卫，Node 22.19 与 24 两个版本）；发布改为
npm Trusted Publishing (OIDC) —— 不再依赖长期有效的本地 token，发布产物带 provenance 证明。

功能面与 v0.3.3 完全一致：双语（中/英）运行时文案、会话头徽标、45% / 60% 双档提醒、
45% 起零 LLM 自动起草交接、宿主状态路由 GET /api/context-guard/state、可选微信外推（默认关）、
加固过的写文件路径。上下文税为 0：不注册 model-facing 工具、不注入 prompt 段落。