fix(engine): CRLF frontmatter, shared per-OS paths, multi-platform spec amendments

[siracusa5]

Summary

First slice of the multi-platform downloads work: Intel Mac, a Linux .deb, a CLI that installs and runs without the Mac app, and the Windows MCPB. This PR records those decisions in the specs and lands two engine fixes the rest builds on. A file saved with Windows line endings now keeps its frontmatter. The app, its bundled CLI, and the npm CLI now agree on where the manifest lives on every OS.

Changes

• Specs (dated amendments, originals kept):
  • Distribution spec: new "Platforms" acceptance criteria. Intel Mac and Linux .deb x64 are in scope; AppImage, a Windows desktop app, and non-macOS self-update stay out, with the reasons.
  • Distribution design: new §11 covering the release platform table, per-OS install and config locations, Linux .deb specifics, and split release jobs.
  • Control-plane spec and design: npm before Homebrew, dispatcher moves into the engine, npm package ships fixtures/*.json, Windows milestone starts with the read path.
  • Channels and site specs: out-of-scope and /install requirements updated.
• CRLF frontmatter (packages/core/src/frontmatter.mjs):
  • Four readers each checked startsWith("---\n"): okf-local, files, layer-files, promote. A CRLF file lost its type, title, and dates without warning.
  • Past that check, the last field kept a trailing \r and was dropped.
  • All four now use one helper, and frontmatter writes keep the file's line endings.
• Shared per-OS paths (packages/core/src/platform-paths.mjs):
  • Config, data, and cache for macOS, Linux (XDG), and Windows, per control-plane §5.12, with CONTEXTCAKE_* overrides.
  • The app-bundled CLI always answered the macOS path; the npm CLI answered ~/.config on Windows. Both now read their default manifest from the helper.
• Promotion bindings now live in the data directory:
  • On macOS they used to sit in a Local State folder inside Electron's userData. Chromium keeps a file of that name there, so staging a promotion failed with ENOTDIR on any Mac that had run the app.
  • Bindings already staged in the old location are still read and cleaned up.
• CLAUDE.md key-files rows for both new modules; the desktop "pinned three places" gotcha now names platform-paths.mjs.

Test Plan

• Root npm test: 65/65 suites, retrieval eval shows no regression
• apps/desktop: npm test 153/153 on Node 22, test:cli-status, test:navigation
• New frontmatter suite: CRLF and LF parse identically; a CRLF frontmatter write reads the last field and keeps CRLF
• New platform-paths suite covering darwin, linux (incl. relative XDG ignored), win32, overrides
• Staged npm package test: the built CLI resolves its default manifest through platform-paths.mjs
• ENOTDIR fix verified: profile-runtime-test.sh run without CONTEXTCAKE_LOCAL_STATE_DIR under a HOME where Local State is a file. It passes; the old path fails with ENOTDIR.
• CI checks pass

Notes

• No user-visible behavior changes on macOS except the promotion fix. The CLI's default manifest path on macOS is unchanged.
• Linux users of the (unpublished) npm CLI would have used ~/.config/ContextCake; it is now ~/.config/contextcake per §5.12. Nothing has shipped there.
• apps/desktop npm run smoke was not run: it needs a console build, and nothing here touches app startup.
• Before the npm step: contextcake and context-cake are both unregistered on npm. Reserve them with hand-published 0.0.0 placeholders.

🤖 Generated with Claude Code