v0.8.43

@truealter/cli@0.8.43 is staged on npm and reaches installers when a maintainer approves it with 2FA.

npm install -g @truealter/cli

Fixed

• Every image in this README now resolves on npm. All five were relative paths
  into docs/, and files ships only dist, LICENSE, README.md and
  SECURITY.md, so docs/ has never been inside a tarball. The npm listing
  rendered a broken masthead and four broken terminal shots, which are the only
  demonstration of the product on that page. They are now absolute raw URLs
  against the public true-alter/cli repo, which resolve on GitHub and on npm
  alike and change nothing about what ships.
• The masthead subtitle drops its trailing fullstop.
• A clean pull no longer breaks the build, and a type error can no longer take the CLI off the machine. 249 files under node_modules/ were tracked, npm's installed-state marker among them, so a pull overwrote the puller's record of what was actually installed and npm then did nothing, including when told the exact version. The build failed naming the wrong file, because the source was correct and the dependency on disk was not. The vendoring was never a decision: the repo's first commit carried a .gitignore written as one literal line, node_modules/\ndist/, which matched nothing, and only that first install's typescript and @types were ever caught by it. Every workflow here installs with npm ci, which removes the directory outright, so nothing read those files. The build now type-checks before it cleans, so a failure leaves the previous dist standing rather than deleting it and leaving the linked binary pointing at nothing.
• A test now fails if anything in the index matches a .gitignore rule, and if any .gitignore line carries a literal escape sequence. The second check is the one that would have caught this at the first commit rather than four months later, because a rule written as node_modules/\ndist/ reads correctly to anyone who opens the file while matching nothing at all.

Security

• Bumped build-time dependencies to their advisory floors: js-yaml (via eslint) to 4.3.1, ip-address (via the sigstore signing chain) to 10.3.1+, brace-expansion (via eslint's and typescript-eslint's minimatch) to 1.1.18 and 5.0.9 on its two separate lines, and @sigstore/core (via @sigstore/sign) to 3.2.1. None of these ship in the published package, since files only carries dist/, never node_modules. A compromised build-time transitive dependency still reaches everyone who builds from source, so the floors are worth holding regardless.