Gemba 0.2.0

Windows joins Linux and macOS as a supported platform, with the same behaviour and the
same guarantees. One change refuses a gemba.yaml that 0.1 accepted: a workstream
named after a device Windows reserves, listed under Changed.

Added

• Windows is a supported platform, beside Linux and macOS: Windows 10 or later with
  Git for Windows at its defaults, no administrator rights and no Developer Mode, from
  PowerShell, the command prompt or Git Bash. The README has a section on it.
• Python 3.14 is supported. The CI runs the suite on every pull request and every push
  to main: on Linux with every supported Python, 3.11 to 3.14, and on macOS and
  Windows with 3.11 and 3.14.
• The ide command of gemba.yaml takes a structured form, { command, args },
  beside the string, which is split as a POSIX shell splits it; the command is
  resolved on PATH the way the platform does, so code finds code.cmd on Windows,
  and an ide command found nowhere on PATH is reported with its name.
• gemba init writes a .gitattributes that keeps LF line endings in the files
  Gemba owns, and completes an existing one like the .gitignore: running it again on
  a tasks repo made before this version adds it.
• A git failure on a path too long for Windows gets a hint naming core.longpaths.
• SECURITY.md: how to report a vulnerability privately, the threat model of the CLI,
  what is in scope and what is not, and the automated checks of the repository. The
  workflows that test, build and publish the package pin every action to a commit and
  run with read-only permissions.

Changed

• Workstream identifiers and note slugs refuse the device names Windows reserves
  (con, nul, aux, com1...) on every platform, so that a tasks repo moves
  between platforms: a gemba.yaml that declares a workstream with one of those names,
  accepted by 0.1, is refused, and the workstream has to be renamed.
• Every file Gemba writes ends its lines with LF, every file it reads accepts CRLF,
  and its output is UTF-8 whatever the console: a task file checked out with CRLF
  records and launches like any other, and a draft filed as a note takes LF line
  endings and loses a leading byte-order mark.
• task.md in a harness is a symbolic link where the system lets Gemba create one
  and otherwise a file holding the relative path of the task; the guide describes
  both forms.
• gemba harness remove and gemba worktree remove delete read-only files, retry a
  path another program holds open, and when it stays held say what is left, that an
  IDE window or a terminal on the folder is the likely cause, and that running the
  removal again finishes it.
• The skills read today's date from the environment, naming the command for a POSIX
  shell and for PowerShell.

Fixed

• The help of gemba harness remove says that the uncommitted paths of the harness
  repository are listed and deleted with it, as the command does, instead of saying
  that they stop the removal.