fix: harden installers and release controls

[SiliconState]

Summary

• enforce exact whole-string release tags and reject unsafe existing installer destinations
• add rollback-preserving Windows replacement fallback only for explicitly unsupported File.Replace, with recoverable backup retention if rollback fails
• expand Unix/Windows installer regressions for strict tags, destination safety, fallback disablement, generic I/O fail-closed behavior, unsupported replacement, rollback, and retained recovery backups
• require annotated release tags whose commit is contained in origin/main
• correct incomplete CLI auth guidance to use Dext's /login paste path for keys or manual OAuth callbacks
• extend the pinned Pages action's deployment poll deadline after the merged run hit its 10-minute default
• record verified GitHub governance gaps in R-008 without mutating repository settings

Fresh-eyes findings fixed

1. newline-tainted DEXT_VERSION values bypassed installer tag validation
2. Windows had no intended unsupported-File.Replace fallback and could discard a recovery backup after uncertain failure
3. existing destination directories/links/reparse points were not rejected before installation
4. Windows installer tests omitted fallback-disabled behavior and replacement rollback paths
5. release tags were not source-enforced to be annotated or contained in origin/main
6. CLI auth retry text promised a paste prompt that incomplete OAuth/API flows do not consistently provide
7. canonical auth references still advertised [key] arguments
8. Pages deployment used the action's 10-minute default and the merged run timed out
9. repository governance settings were assumed rather than verified

Verification

• Unix installer harness under sh, Bash POSIX mode, and Bash 3.2 compatibility
• python3 scripts/validate_pages.py docs
• cargo fmt --all -- --check
• cargo clippy -p dext --all-targets --all-features --locked --no-deps -- -D warnings
• cargo audit --deny warnings
• cargo deny check licenses
• cargo test -p ratatui-core --lib --locked (1,439 passed)
• cargo bench --no-run --locked
• cargo build --release --locked
• cargo test --release --locked (908 passed)
• cargo test --release --locked --test tui_smoke -- --nocapture (4 passed)
• cargo install --path . --force --locked; /home/baks/.cargo/bin/dext --version -> dext 0.1.0
• PNG structure/CRC/decompression/OCR review for both documentation captures

CI-required validation

Local pwsh, actionlint, and a local YAML parser were unavailable. Require all Ubuntu, macOS, and Windows PR jobs before merge; Windows executes the production PowerShell harness.

Governance gaps retained in R-008

Verified 2026-08-06: main requires Ubuntu/macOS but not Windows; no rulesets/tag protection; private vulnerability reporting, vulnerability alerts/Dependabot security updates, and immutable releases are disabled. This PR does not mutate repository settings.

[SiliconState]

Reopening unchanged to regenerate the pull_request CI event dropped during the GitHub Actions outage. Exact head remains f9791a6.

[SiliconState]

Windows installer follow-up is fixed and independently verified on the revised source tree.

Root cause: Windows PowerShell 5.1/.NET Framework can expose RuntimeInformation.OSArchitecture as null; install.ps1 called .ToString() on it before emitting installer output. The installer now uses native Windows architecture environment values, including PROCESSOR_ARCHITEW6432 for a 32-bit shell on 64-bit Windows.

Successful recovery run: https://github.com/SiliconState/Dext/actions/runs/31127173834

Evidence from the Windows job:

• C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE parser/help passed.
• Full in-memory Invoke-Expression install matching irm | iex passed.
• Windows installer tests passed under Desktop PowerShell 5.1.26100.33158.
• PowerShell 7 parser/help and the same full harness passed.
• Windows installer tests passed under Core PowerShell 7.6.4.
• Ubuntu, macOS, and Windows all passed on the identical source tree.

GitHub's active Actions incident states that push/PR webhooks are throttled to about 15%, so the PR synchronize/reopen events were dropped and the successful dispatch checks are not attached to the PR rollup. PR remains intentionally unmerged until attached protected checks can run after recovery. The empty synchronization commit changes no tree bytes.

[SiliconState]

GitHub reports webhook throughput restored. Reopening unchanged head d9df545 to generate the PR-attached protected checks; this commit has the exact same tree as the fully passed f9791a6 dispatch run.