v2.0.0 — 删除无效的 device 形参，CI 扩到 macOS/Windows

Breaking

• ChassisSimEnv(device=...) and cs.make(..., device=...) are gone. The parameter
  had been inert since 1.0 — the encoder lives in the Actor and ContextBuilder only
  computes numpy — and was documented as inert. A no-op keyword is still public API, so
  removing it is a major bump rather than a patch: ChassisSimEnv(device="cpu") now
  raises TypeError: __init__() got an unexpected keyword argument 'device', and
  cs.make(device="cpu") raises ValueError: 未知的 make() 参数 ['device'] followed by
  the 57 accepted keys. Grep training scripts for device= before upgrading; nothing
  else about the constructor changed.
• The matching entry is gone from both READMEs' Known limitations sections, which
  are renumbered (nine items, no gap).

Changed

• CI now runs the same suite on macOS and Windows (new test-os job: Python 3.12,
  [dev,viz,planning], shell: bash, PYTHONUTF8=1), so the declared
  Operating System :: OS Independent classifier has something behind it instead of an
  ubuntu-only history. ubuntu still covers 3.10–3.13. The matrix values are written as
  arrays: a scalar python-version keeps the YAML valid but makes GitHub reject the whole
  workflow (the run then fails with zero jobs and no logs), so tests/test_ci_workflow.py
  pins that shape as well as the job's shell: bash steps.
• The planning parity golden compares cusp_rejections only in strict mode. That
  count is discrete: both of its criteria (min_cusp_fold_arc, min_cusp_leg_separation)
  compare a float against a fixed threshold, so a single ulp decides whether one candidate
  is rejected. On the first macOS/Windows run the generated obstacles, path and headings
  matched inside 1e-9 while the counter read 1 vs 0 and 1 vs 2 — the same path after a
  different number of retries, not a porting error. CHASSIS_STRICT_GOLDEN=1 still
  asserts it, and the invariant that matters — a generated path contains no violating
  cusp — is asserted independently by test_cusp_filter_effective_on_generated_paths.

Fixed

• Worker crash logs no longer vanish on Windows. reset() and step() wrote the
  traceback to a hard-coded /tmp/ackermann_worker_crash.log; Windows has no /tmp, so
  open() raised FileNotFoundError, the surrounding except swallowed it, and the
  diagnostic disappeared. The path now comes from tempfile.gettempdir() and the write is
  explicitly UTF-8 — a Chinese traceback cannot be encoded through the default ANSI code
  page either.

No other functional changes: observation layout, rewards, sensors, controllers, planning
and rendering are untouched in this release.