release: v0.6.31 comprehensive review remediation

[bbingz]

Summary

Closes all 14 confirmed findings from the v0.6.30 comprehensive review and prepares v0.6.31.

• makes no-diff JSON v2 results, provider target parsing, TUI effects, active-job status, and ledger preview persistence truthful
• hardens provider process lifecycle, bounded capture, typed failures, prompt transport, and provider session identity
• makes background start, cancellation, SessionEnd, recovery sidecars, and terminal ledger publication race-safe
• validates all five generated companions plus terminal metadata from source before any in-place rebuild
• bumps host, terminal, and OpenCode to 0.6.31 and utils to 1.0.5; timing remains 1.0.2

Review disposition

All 14 findings have dedicated source and regression evidence. Five scoped independent reviews passed. The final whole-branch gate at b9dade0 returned:

• Spec Compliance: PASS
• Code Quality: APPROVED
• Release Readiness: READY

Native Windows execution was unavailable and is explicitly disclosed: Windows argv and taskkill/deadline branches have deterministic simulated coverage; POSIX process-group and process-tree behavior has native coverage.

Verification

• npm run release:check: exit 0
• npm test: 906 passed, 0 failed
• source-derived artifacts: 6 checked
• strict fixture freshness: no stale fixtures
• manifests: 0.6.31 aligned
• host map: 13 capabilities across 4 adapters plus terminal
• installed CLI review flag drift: all 11 probes OK
• both Claude plugin validations passed
• OpenCode, utils, timing, and terminal package dry-runs passed

No real provider invocation was used for remediation verification.