fix: resolve 25 pre-publish blockers

- postinstall.mjs: fix alias package detection
- migrate-legacy-plugin-entry: dedupe + regression tests
- task_system: default consistency across runtime paths
- task() contract: consistent tool behavior
- runtime model selection, tool cap, stale-task cancellation
- recovery sanitization, context-limit gating
- Ralph semantic DONE hardening, Atlas fallback persistence
- native-skill description/content, skill path traversal guard
- publish workflow: platform awaited via reusable workflow job
- release: version edits reapplied before commit/tag
- JSONC plugin migration: top-level plugin key safety
- cold-cache: user fallback models skip disconnected providers
- docs/version/release framing updates

Verified: bun test (4599 pass), tsc --noEmit clean, bun run build clean

postinstall.mjs

@@ -1,6 +1,7 @@
 // postinstall.mjs
 // Runs after npm install to verify platform binary is available
 
+import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { getPlatformPackageCandidates, getBinaryPath } from "./bin/platform.js";
 
@@ -24,7 +25,7 @@ function getLibcFamily() {
 
 function getPackageBaseName() {
   try {
-    const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    const packageJson = JSON.parse(readFileSync(new URL("./package.json", import.meta.url), "utf8"));
     return packageJson.name || "oh-my-opencode";
   } catch {
     return "oh-my-opencode";