MeshCue 1.4.2

Windows bug-fix release (#11). On Windows, open never started the workbench; it does now.

• The bundled release cache no longer fails its own verification on Windows (CACHE_CHANGED). Cache identities on macOS and Linux are unchanged.
• On Windows the Agent channel is a named pipe with a fresh random name per start, recorded only in the project's private state. The runtime directory is restricted to the current user, SYSTEM and Administrators, and setup fails closed if that cannot be done. The client proves it is talking to its own server before sending anything; a pre-existing pipe of the same name makes the server refuse to start. Connections that send nothing are dropped after 5 seconds.
• Workspace paths returned to the Agent (project, precheck file) use / on Windows too, so they can be passed straight back.
• MCP initialize instructions no longer include the Skill's YAML header when the checkout uses CRLF line endings.
• README notes that an older Claude Code may not support the archive plugin source; update Claude Code if claude plugin install reports that.
• Dependencies: proxy-addr 2.0.8, source-map-js 1.2.2.

Tested on a real Windows 11 machine: CLI, packaged plugin and MCP each opened a review, a mark was placed in Chromium, submitted and read back, including under a restricted (non-administrator) token. Known limits: a true Medium-integrity user session, cross-user and remote SMB access were not tested; other local accounts can still open the pipe read-only (they cannot send requests). Several tests in the Node suite still assume POSIX and fail on Windows; they do not affect the product.

Thanks to @ccj241 for the detailed report.

This release is commit bf2972a.