chore: consolidate reviewed fixes and finalize project presentation

[Tom409114]

Summary

Consolidates the useful runtime and evidence-tooling changes from #82 without regressing the working 0.1.2 release workflows. Includes the dependency patch updates from #85, #86 and #87, an accurate bilingual published homepage, and ready-to-use launch drafts.

Rule semantics changed?

Yes. Improves POSIX compound/case parsing, target-specific PS026 argument handling, executable provider aliases, and manager-aware workspace dependency visibility. Workspace versions must satisfy declared semver ranges before satisfying PS040. Adds semver as the fifth direct runtime dependency; bundled Action remains self-contained.

Publication and evidence

npm 0.1.2 and its immutable tag remain unchanged. The homepage cites the actual successful bounded manual-finalization run and verifies exact workflow runs, source revisions, Release assets, aliases, npm SRI and tarball bytes. Post-release main fixes are distinct from that published artifact. Historical pre-release reports remain labeled historical; external adoption is not fabricated.

Test evidence

Local Windows Node 24: 74 files passed; 1281 tests passed, 9 conditionally skipped. Parser/rule coverage: statements 95.26%, branches 90.04%, functions 96.81%, lines 97.78%. Build, typecheck, Biome, frozen-lockfile offline install, bilingual parity, live release verification and external-directory npx 0.1.2 smoke passed. Independent review completed and its publication-run verification finding was fixed and retested. Two Git/shell-heavy tests use measured 15-second budgets instead of the 5-second unit-test default. Hosted CI must pass before merge.

Risk and rollback

Conservative rule changes may change findings; regression fixtures cover target parsing and workspace resolution. Revert this consolidation commit to roll back main; published tarball and immutable release tags are untouched. Do not merge the stale #82 release workflows wholesale. Superseded branches will be removed only after this PR merges.

Checklist

• Regression tests and documentation updated
• No analyzed script execution or telemetry
• Runtime dependency justified and below 10 direct dependencies
• Existing immutable action pins preserved
• Launch materials are drafts only; no external promotion sent