Refresh Pi memory and add test, CI, and release safeguards

[RodCor]

Earlier memory injections could survive corrections and branch changes, and the shared 10-second timeout could interrupt session saving. Keep only the active task's injection in model requests, omit raw injections from new summaries, and allow session saving up to five minutes. Improve the skill's guidance for reuse, corrections, and meaningful citations.

Harden the repository after the integration test exposed ancestor-repository discovery:

• Use independently anchored temporary Git workspaces and isolated homes, caches, user brains, and transcripts; exclude inherited credentials and Git/Kimetsu overrides before subprocesses start.
• Require real Kimetsu 2.8.0 integration tests on Linux, macOS, and Windows, with checksum-pinned binaries and a required aggregate CI check.
• Pin Actions to commit SHAs, scope permissions, limit job duration, and require successful main-branch CI for the exact commit being published.
• Add contributor safeguards and weekly dependency updates; patch Vitest to 4.1.11 (audit: zero vulnerabilities).

Validation: all 34 tests pass with the real CLI on Node 22.19.0; typecheck and package dry-run pass; missing-binary integration gate fails as intended; the developer home-brain checksum remains unchanged. Independent code review found no important issues. Package version remains 0.1.3; this PR does not publish a release.

Canonical companion: RodCor/kimetsu#47. Merge this PR first so the companion asset drift check can pass.