fix: complete repository integrity remediation

[efraespada]

Summary

• add bounded streaming decompression and isolate-safe native memory ownership
• harden Android, Apple, Linux, Windows, WebAssembly Worker, and CLI implementations
• expand real integration, instrumentation, property, sanitizer, artifact, and coverage checks
• secure CI and split release preparation, OIDC publication, and reviewed integration
• reconcile documentation and include the full 23-section audit report

Verification

Local macOS/Apple Silicon, Android ARM64, iOS Simulator, Web/Chrome, CLI, CMake, sanitizer, analyzer, formatter, metadata, YAML, shell, and actionlint checks passed. Hosted platform workflows and the required Pull Request Safety Gate also passed on this branch.

Codecov now evaluates all three expected flags on every trusted PR head. Patch coverage is 100%, project coverage is 96.86% (up from 54.10% on the base), and the enforced package results are: CLI 100%, platform interface 85.71%, and zstandard 88.33%. Forks enforce the same local thresholds without receiving repository secrets.

No package publication or release is performed by this PR.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/zstandard~144

Documentation is deployed and generated using docs.page

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.86%. Comparing base (16a489f) to head (a87d1f5).

Additional details and impacted files

@@             Coverage Diff              @@
##           develop     #144       +/-   ##
============================================
+ Coverage    54.10%   96.86%   +42.76%     
============================================
  Files           12       10        -2     
  Lines          573      287      -286     
============================================
- Hits           310      278       -32     
+ Misses         263        9      -254     

Flag	Coverage Δ
cli	100.00% <100.00%> (+50.29%)	⬆️
platform_interface	85.71% <100.00%> (ø)
zstandard	88.33% <100.00%> (+1.29%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.