docs(security): clarify resolver exposure

[steipete]

What Problem This Solves

The 0.5 changelog described the resolver hardening without identifying the affected release range, the direct-helper exposure, or the unaffected root() handle boundary. Consumers auditing deployments pinned to 0.4.7 could not assess their exposure precisely.

Why This Change Was Made

Document that published releases through 0.4.7 validated a lexically normalized spelling in resolveRootPath() and resolveRootPathSync(), and that 0.5 fixes this through component-wise alias resolution. Explicitly separate those exported helpers from root() handles, whose operations have contained this case since 5ddca80.

User Impact

Documentation only; package behavior is unchanged. Direct users of either resolver helper now have a clear 0.5 upgrade instruction, while root() handle users can see that this specific exposure did not affect them.

Evidence

• pnpm docs:site

• pnpm check (58 files passed; 632 tests passed, 7 skipped)

• git diff --check

• Autoreview: clean, no accepted/actionable findings

• Tests added or updated when behavior changed (no behavior change)

• Security and compatibility impact considered

• CHANGELOG.md updated when release-relevant

• No credentials, private paths, private hosts, or sensitive contents included

Related: #65

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: docs(security): clarify resolver exposure This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.