v3.12.1: nested attestation and cross-platform fixes

What changed:

• Running an attestation helper inside .planning/<slug>/ now updates the slug .attestation instead of creating a legacy file.
• macOS system aliases, Windows active-plan pointers, Unix PowerShell refusal, and trusted interpreter fallbacks now behave consistently across the supported matrix.

Thanks: @sortakool for reporting issue #234 and providing the exact reproduction and root-cause trace.