feat: ship verified goal workflows for v0.6.2

[willytop8]

Summary

Prepare opencode-goal-plugin 0.6.2 as a verified, compatibility-tested release.

Changes

• add generated lifecycle-model, critical mutation, installed-package TypeScript, packed-host, and complete tool-surface contracts
• expand CI across Node 18/20/22/24 and Linux, macOS, and Windows; add CodeQL, Dependabot, and a verified tag artifact workflow
• preserve multi-goal creation order when paused goals resume
• keep paused and crash-recovered goals inert, and enforce status/history/list/pause/clear turns as read-only when OpenCode routes command text into the model
• document supported compatibility, provider-backed lifecycle canaries, release integrity, and private vulnerability reporting
• narrow the published package to the intended 24-file runtime, documentation, demo, and verifier surface

Why

Real OpenCode 1.17.15 lifecycle testing showed that the host can route slash-command text into stale conversation history after command-side state changes. Without tool-boundary enforcement, status or clear turns could resume or recreate work. This release adds enforceable command-turn guards and proves restart, compaction, pause/resume, blocker, continuation, and clear behavior against a live provider-backed host.

Validation

• npm run release:check
• 249/249 tests
• 98.46% line / 90.50% branch / 89.98% function coverage
• 4,000 generated lifecycle transitions
• 5/5 critical mutants killed
• behavior benchmark: 100/100
• strict NodeNext and Bundler installed-package type contracts
• exact 11-tool packed package contract and all 7 required host hooks
• production audit: 0 vulnerabilities
• final package allowlist: 24 files
• provider-backed OpenCode 1.17.15 canaries for completion, auto-continuation, pause/resume, blocker/restart, hard-process recovery, compaction, and stale-history clear enforcement

Release safety

This PR does not publish to npm. The v0.6.2 tag workflow will rerun the complete gate and retain the exact tarball for maintainer review and publication.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.