session-recap 0.3.1: review fixes and polish

Fixed

• dsh: a migrated session is read from its newer file, not the larger pre-migration one.
• An update re-reads the last prompt the previous recap covered, so a reply that
  arrived after a mid-turn recap is no longer lost.
• The Claude Code plugin's store is pruned (newest 250 recaps, 100 part notes)
  and old 0.2 keys are removed, so it never reaches its 4 MiB limit; part notes
  are written without a shared index, so parallel parts cannot overwrite each other.
• Installed skills give the CLI's full path as a fallback for agents whose tools
  run without the shell's PATH.
• CODEX_HOME / DSH_HOME in a shell profile no longer make the CLI think it runs
  inside Codex or dsh.
• SESSION_RECAP_API without a key or base URL no longer mixes with another
  provider's endpoint and key.
• OpenCode database paths with #, ? or % open correctly.

Changed

• /session-recap and name lookups scan sessions once instead of three times;
  session-recap list scans once instead of once per project.
• Code quality: the CLI is fully typed (JSDoc, checked with tsc --strict); Python is
  linted and formatted with ruff, JavaScript with Prettier; CI runs all three.
• Added CONTRIBUTING.md, SECURITY.md and .editorconfig.