v0.44.1 — the standalone .mcpb review panel opened blank

Packaging-only patch; no engine, safety, or write-path behaviour changed.

Fixed

• The review panel opened blank from the standalone (Route B) .mcpb. The frozen citevahti-mcp binary collected the citevahti code but not its data files, so the panel's web assets (citevahti/panel/web/) weren't in the executable — every static file 404'd when open_review_panel served the panel from inside the binary. build-binary.sh now passes --collect-data citevahti and fails the build loudly if the panel assets are missing from the freeze manifest. The desktop app (CiteVahti.app, which serves the panel from the citevahti-engine sidecar) and the Python-route .mcpb were unaffected.
• The CI-built release .mcpb assets had the same gap — plus no keyring. The release workflow freezes the binary with its own PyInstaller invocations, which were missing --collect-data citevahti and never got the 0.44.0 keyring fix — so the win/linux/mac .mcpb files attached to earlier releases shipped with a blank panel and a dead keychain path for "Connect Zotero". All three CI freeze invocations now match the local script, and a platform-neutral "Verify freeze" step fails the workflow if either is missing. The broken .mcpb assets have been removed from the v0.44.0 release.
• New offline regression test (tests/test_panel_static_assets.py): every asset the panel server promises to serve exists on disk, and every local script/stylesheet index.html references is on the allow-list.

⚠ Updating an installed extension

Claude Desktop caches the old .mcpb — reinstalling over the top does not refresh it. Remove the CiteVahti extension, fully quit and reopen Claude Desktop, then install the new .mcpb and confirm with the status tool that it reports 0.44.1.