fix: harden output and release stability

[tt-a1i]

Problem and value

Archify's output paths were not consistently protected against input aliases, symbolic links, hard links, case/Unicode aliases, or last-moment target changes. Release-facing version labels, package contents, documentation, and tag behavior also needed one deterministic identity contract.

This PR makes output commits fail closed before user inputs or paired outputs can be replaced, and makes the exact zero-dependency archive and development release identity verifiable before publication.

No originating issue exists for this internal stability slice.

Scope

• What changed:
  • Centralized output-path resolution and alias detection across render, deliver, preview, and architecture compare.
  • Rechecked guarded paths immediately before writes and atomic commits.
  • Added structured output-path diagnostics and doctor coverage.
  • Established the unreleased development identity v2.13.0-dev.0 across package metadata, Skill metadata, docs, templates, and generated artifacts.
  • Added release-identity, output-path, and package-gate regression suites.
  • Smoked the exact release archive before upload, classified prerelease tags truthfully, and expanded CI to Node.js 18, 20, 22, and 24.
  • Clarified Raven's manual ZIP installation boundary and synchronized Node support guidance.
• What deliberately did not change:
  • No diagram schema, authored topology, renderer layout policy, automatic-routing behavior, quality threshold, hosted service, or dependency was added.
  • The later 44-case corpus findings are not repaired in this PR; this commit is the frozen SUT that exposed them.
• No unrelated changes: confirmed. Existing untracked local research and experiment files were not staged.

Stability impact

• Compatibility and migration risk:
  • Unsafe meta.output values that are absolute, escape the working directory, resolve through a symlink outside it, do not end in .html, or alias an input now fail closed.
  • Explicit CLI output paths retain their existing flexibility but cannot alias inputs or paired output targets.
• Renderer, validator, package, or generated-artifact risk:
  • Shared path handling affects all five renderers plus preview, deliver, and compare.
  • Release identity changes regenerate checked-in examples, Gallery receipts, proof media, and archify.zip.
  • Tests cover symlink, hard-link, case/Unicode, future-path, pre-commit recheck, package, and version-identity behavior.
• Failure behavior and rollback path:
  • Rejected paths return structured diagnostics; failed delivery preserves the prior trusted artifact.
  • Roll back by reverting commits 290510c and 18e6f7f.
  • Residual risk: descriptor-free filesystem APIs cannot entirely remove a hostile check-to-rename race, and Windows filesystem semantics are not directly exercised.

Tests run

• cd archify && npm test
  • 561 tests passed, 0 failed.
• cd archify && npm run test:webm
  • Passed; WebM artifact sampled 10 frames and all 10 were unique.
• cd archify && npx -y node@18 --test --test-name-pattern="cli: deliver --open launches" test/cli.test.mjs
  • Reproduced the initial Node 18 CI failure before the fixture fix; passed after converting the extensionless fake opener to CommonJS.
• scripts/build-zip.sh /tmp/archify-merge-gate.IG50Dn/fresh.zip
  • Passed; 75 packaged files.
• unzip -tq /tmp/archify-merge-gate.IG50Dn/fresh.zip
  • Passed with no compressed-data errors.
• diff -qr /tmp/archify-merge-gate.IG50Dn/fresh/archify /tmp/archify-merge-gate.IG50Dn/checked/archify
  • No differences from the checked-in archify.zip.
• node scripts/package-smoke.mjs /tmp/archify-merge-gate.IG50Dn/fresh/archify
  • Passed on macOS without installing dependencies.
• git diff --check main...HEAD
  • Passed.

Visual evidence

Visual review skipped: this PR introduces no intended diagram geometry or visual behavior. Generated version labels, proof hashes, the checked-in Architecture Delta artifact, and proof media were rebuilt and exercised by the deterministic artifact and WebM gates above.

Generated artifacts

• Rebuilt archify.zip.
• Regenerated affected example HTML, Gallery HTML/manifest/artifacts, Guide/Start/Landing pages, Architecture Delta proof, live-proof GIF, and their receipts/hashes.
• Fresh archive contents are tree-identical to the committed package.

Checklist

• I used a minimal focused change and preserved existing typed JSON behavior unless the issue requires a contract change.
• I ran the relevant targeted tests and npm test in archify/.
• I added or updated regression tests for behavioral changes.
• I checked generated artifacts and package freshness when their sources changed.
• I removed secrets, private repository content, and customer data from fixtures and screenshots.