CD - fix: harden script execution, config parsing, and CI release gate (#12) * fix: harden script execution, config parsing, and CI release gate Escape cmd.exe metacharacters in forwarded args, reject invalid and explosive script graphs, scope --no-hooks to pre-command argv, and run CI tests on main before publish. * fix: add missing ci-install run-script used by CI/CD * chore: ignore PLR0917 alongside existing too-many-args lint rule (from CI)

CD - fix: harden script execution, config parsing, and CI release gate (#12) * fix: harden script execution, config parsing, and CI release gate Escape cmd.exe metacharacters in forwarded args, reject invalid and explosive script graphs, scope --no-hooks to pre-command argv, and run CI tests on main before publish. * fix: add missing ci-install run-script used by CI/CD * chore: ignore PLR0917 alongside existing too-many-args lint rule (from CI) #12