fix(deps): reject malformed exponent signs in Codex configuration #163

Problem

The pinned smol-toml@1.9.0 accepts malformed floating-point exponent signs, such as foo=3e++20 and foo=3e--20, returning {foo:3}. sqliteHome() treats a successfully parsed configuration without a root sqlite_home as default; these malformed configurations should instead remain unknown, with doctor/send reporting codex_config_unreadable.

This is a reproduced dependency correctness defect, not a demonstrated storage-relocation bypass or published CVE. Fresh npm advisory checks and open Dependabot/CodeQL alerts found no current published vulnerability. The deferred #155 harness and distribution-excluded experiments remain outside this patch.

Change

• Pin the official parser patch smol-toml@1.9.1, preserving unrelated dependency versions.
• Add regression coverage for malformed exponents, doctor uncertainty and refusal before dry-run/submission; preserve valid exponents and explicit relocated-storage refusal.
• Prepare version 0.5.1, retaining exact-version SSH and the same four finite skill profiles as 0.5.0. Validate the actual package and normal repository protections before publication.

Upstream fix: https://github.com/squirrelchat/smol-toml/releases/tag/v1.9.1
Upstream comparison: squirrelchat/smol-toml@v1.9.0...v1.9.1

The user requested fixes for actionable security/dependency issues and a hotfix release. Actual protected-environment/npm stage authentication and source approval remain release gates; no fleet/global installation is requested.