fix: restore cross-platform release proof for v0.2.18

[troyjr4103]

Context

Release v0.2.17 was quarantined after the mandatory public install proof failed on all five runners. Its signed assets exist for audit, but npm, GHCR version tags, Homebrew, installers, and GitHub Latest were not promoted. Failed run: https://github.com/firelock-ai/kin/actions/runs/29175301078

Fixes

• keep Unix install-proof shell selection stable across Actions steps and report exact unhealthy checks
• replace three nonportable Windows parent-directory fsync calls with Unix-only metadata sync while preserving file flushes and atomic namespace operations
• add a native Windows init, daemon reopen, and persisted-index smoke to normal CI
• make README installation links follow the proven GitHub Latest release instead of an unpromoted tag
• cut the workspace and npm packages to v0.2.18, with transparent quarantine notes

Verified locally

• actionlint on edited release workflows
• release authority, installer parity, npm automatic release, and npm verifier regressions
• npm tests and lint for both public packages
• cargo fmt
• exact directory portability and save/restart authority tests
• full kin-daemon suite
• registry-only lock provenance preserved; exactly 20 workspace lock entries changed to 0.2.18
• kin-vfs-core remains 0.1.4 at checksum 2fbdfd41caf204a56ab7f6153cc9c9199a02c01a37b932d494fbbb506d85d644 and all four VFS release pins remain 64d94af54cd049a54c999e20857f5eec4bcde45c

Required before merge and release

• all hosted checks green, especially the Windows vector-free runtime smoke
• independent exact-head review
• release-clean registry-only build

After merge, v0.2.18 must pass all five public install-proof jobs before automatic npm publication or GitHub Latest promotion. This PR does not claim v0.2.18 is live.