Prepare v0.0.2-beta with nine-platform release acceptance

[LunaStev]

Prepare v0.0.2-beta for Linux amd64/arm64/riscv64/loongarch64, macOS amd64/arm64, Windows amd64/arm64 MSVC, and FreeBSD amd64. Every release platform must execute the workspace tests, package verification, verified Wave installation, and real package/re-export smoke. Quality plus these nine checks replace the previous eight-job matrix; cross-compilation alone cannot satisfy acceptance.

The implementation shares host mappings, pins runtime images and official compiler archive digests, requires acceptance reports for the exact source commit, and attests/verifies archives, reports, and checksums before publication. RISC-V and LoongArch use target userspace through QEMU; FreeBSD runs in a VM. Public provenance bundles are verified without forwarding CI credentials into guests. No dependency-update bot is introduced.

Package-manager changes add exact compiler requirements (including dependency manifests before publication), reject Git submodules, fetch unadvertised locked objects by exact SHA, and exercise clone/fetch/checkout/late-validation/cycle/recovery failures while preserving the prior graph. CLI changes enforce canonical entries, consistent help/color/run phases, structured error context and original compiler diagnostic payloads, and artifact events. A verified user-local Vex installer preserves existing installations on failure. Parser mutation tests, documentation link checks, generated CLI reference and JSON schemas complete the release tooling.

Validation on the development host:

• python3 x.py check: Python tests, workspace Rust tests, formatting, Clippy with warnings denied, workspace build.
• 20,000 deterministic parser mutations, dependency audit (clean), and local/external documentation links.
• Real official Wave 0.2.1 candidate on Linux amd64: generated library guide, Hello World, local/path/transitive Git imports, public re-exports, private access rejection, locked/offline reuse, metadata, artifact/outcome messages, and compiler source diagnostic preservation.
• Installer checksum/provenance/version/replacement failures preserve the previous executable.

Release blockers and operational follow-up:

• Wave v0.2.1-pre-beta is now public (2026-10-05 08:46:50 UTC), source 57376ea90d293e07280b39b1837b71145cc87b20. All nine archive digests were rechecked against the public release and match tools/wave-release.json. The public Linux amd64 installation and full real-compiler smoke passed locally with forced color enabled.
• All nine platform jobs must pass. The first public-artifact run exposed colored Wave version output, which Vex incorrectly treated as a version mismatch. Version probes now request NO_COLOR without changing build/program environments; regression tests cover version mismatch and execution failure separately. The Windows smoke now invokes the selected compiler by absolute path for its own probes while still testing Vex PATH selection. macOS arm64 exhausted the unauthenticated GitHub API rate limit. Native acceptance now scopes its read-only workflow token to API queries only; build/test/compiler/program children and QEMU/FreeBSD guests do not receive it. Python isolation and HTTP-status parsing regression tests pass. At 7764a84, Quality, Linux amd64/arm64, macOS amd64, Windows amd64/arm64 and FreeBSD amd64 passed full public-compiler acceptance. At 2513232, Quality and both Linux amd64/arm64 and macOS amd64/arm64 pass; the macOS rate-limit fix is verified, while the other platform jobs are still running. The latest head must complete all nine platform checks before merge. Earlier long-path fault-injection, BSD socket inheritance, and minimal guest signal-tool issues were fixed in this PR.
• Master ruleset now requires Quality + all nine Platform / ... checks, retaining PR, strict/latest-base, no force/delete and no bypass. No merge bypass is permitted.
• Publish v0.0.2-beta only after the merged source's master-push CI and release workflow gates pass. No Vex release tag has been created by this PR.

Closes #34, closes #36, closes #37, closes #38, closes #44, closes #45, closes #52, closes #61.
Closes #66, closes #67, closes #68, closes #69, closes #70, closes #72, closes #73, closes #74.
Closes #78, closes #80, closes #81, closes #85, closes #86, closes #87, closes #93, closes #94, closes #95, closes #96, closes #97.
Closes #104, closes #126, closes #131, closes #133, closes #137. Roadmap follow-up: #99.