Em dash cleanup, release-only CI, Sound proposal, Import JS Library

[vecnode]

Summary

• Removed em dashes from all tracked markdown docs (AGENTS.md, CLAUDE.md, README.md, SECURITY.md).
• CMakeLists.txt: project version set to 0.1.0.
• .github/workflows/build.yml: now only builds + publishes a GitHub Release when a v*.*.* tag is pushed (or manual dispatch) - no longer runs on every push/PR. Day-to-day rounds stay branch -> PR -> merge with no CI gate. To cut a release: bump the CMake version, git tag vX.Y.Z && git push --tags.
• docs/proposals/sound-section.md: design proposal for a "Sound" side-panel section (master on/off toggle + 0-1 volume slider over sketch audio output, via a wrapped AudioContext.destination). Proposal only, not implemented - for review before building.
• Added an "Import JS Library" button to the Libraries panel: opens a native file picker, reads the chosen .js file's text via FileReader, and injects it into the sketch iframe (same sandboxed, opaque-origin context the sketch itself runs in, so no new attack surface). samples/test-import-lib.js is a minimal file to exercise it.

Test plan

• node --check public/script.js passes.
• Built and ran locally (build_and_run.bat); loaded the app's loopback URL in a browser to verify the DOM (sidebar renders the new "Import JS Library" button under Libraries).
• Simulated a file import via a synthetic File/DataTransfer dispatched on the file input: hint text updated to "Imported: test-import-lib.js", terminal logged the import, and the sketch auto-reran.
• Confirmed the sketch iframe remains a true cross-origin sandbox (SecurityError when trying to reach into it from the parent), i.e. the import path doesn't weaken isolation.
• The Sound proposal is a design doc only - no runtime behavior to test yet.

Generated with Claude Code