ceulen 0.10.1 — Windows load fix, security hardening, composer status layer

Windows extension-load fix

Loading the bundle on Windows crashed with ENOENT ... lstat 'D:\C:': the resources_discover skill path was built with new URL(...).pathname, which yields /C:/... on Windows (leading slash before the drive letter); realpathSync resolved it against the current drive. The bug existed in five modules (web, munin, a2a, ponytail, ux). One shared helper (extensions/lib/skill-path.ts, fileURLToPath) now serves all call sites, with a regression test.

Security & robustness review

• Three settings writers (a2a writeSettingsA2A, repair settings, a2a session registry) now write mode: 0o600 like every sibling writer — the files carry API keys/tokens.
• Router refreshModels no longer throws on null entries in a hand-edited/corrupted models-store.json.
• Web --virtual-time-budget clamped non-negative.
• Subagent worktree patch temp file: randomUUID name + exclusive (wx) write (shared-/tmp symlink hardening).

Composer

Status layer aligned with OMP's actual rendering — POWERLINE row (model · thinking · dir · git) over a context-reactive gauge, per-shape layouts (band/box/claude/rule), OMP threshold colors and number formats.

Install: pi install npm:ceulen