Pre release

[salon64]

Summary

Gets the repo ready for a public release: closes an npm-publish data leak,
fixes a cross-platform install failure, fixes three correctness bugs, and adds
the standard community/docs files. No breaking API changes.

Release readiness

• package.json — narrow files to ["dist","docs/mcp-setup.md"] so
  npm publish can no longer pack local notes from docs/; bump
  better-sqlite3 9→12 (9.x ships no prebuilt binary for Node 22/24, so users
  on the declared engines had to compile from source — 12.x has prebuilds).
• pnpm-lock.yaml — lockfile for the better-sqlite3 bump.
• .github/workflows/ci.yml — expand to a 3-OS × Node 22/24 matrix and add
  test:mcp (validates the native sqlite load + MCP wiring on every platform).
• SECURITY.md, CONTRIBUTING.md — new.
• README.md — reframe the per-fold model routing as a measurable capability
  (not a claimed cost win), add a Prior work section crediting th
  and fix the CLI command line.
• scripts/mcp-smoke.mjs — correct the stale "requires a key" co
  smoke test is keyless (CI now relies on that).
• deps/CI — pin pnpm via packageManager; cap engines.node to >=22 <27.

Bug fixes

• MCP active-node pointer (src/agents/orchestrator.ts, src/mcp src/session.ts) — the stateless MCP tools were persisting the shared trees.active_node_id, so a later CLI openof that tree could re parked/merged branch. Added apersistActiveoption (MCP passesfalse; the CLI keeps true`).
• web_search truncation (src/llm/client.ts) — a search that hit the
  pause-turn round cap returned a partial answer silently. Added a na
  a [truncated…] marker so it isn't summarized as final.
• rollback double-user turn (src/agents/orchestrator.ts) — roll
  onto a user-message index could send two consecutive user turns (provider 400).
  Coalesce adjacent same-role messages in the outgoing payload (`merg

Docs

• .env.example — document the API-key env vars for all 8 providers (was 2).