chore: promote dev to main (open-issues-batch + security fixes)

[LeXwDeX]

Why

Promote the dev integration layer to the release gate. dev now contains main's full history plus PR #444 (issues #434#440#436#442#443 — all specgit-accepted and merged).

What changed

• fix(security): github handler exfiltrates app token via markdown image SSRF (code-scanning #65) #442: github attachment fetch uses the validated URL object; guard unit-tested.
• fix(security): escape OAuth error pages in xai and codex plugins (code-scanning #62, #60) #443: escapeHtml delegates to escape-html (CodeQL-modeled sanitizer).
• fix(dag): review-aggregate nodes repeatedly fail to call submit_result #436: submit_result contract reinforcement + one retry nudge in spawn.
• fix: assemble google key test fixture to stop secret-scanning false positive #440: google-key test fixture assembled, not literal.
• fix(ci): dev-lineage specgit-accept installs CLI locally and chokes on bun catalog #434: dev-lineage specgit-accept template synced to global install.

Evidence

• PR Delivery open-issues-batch #444: CI 8/8 pass on dev base, specgit finish exit 0 (ACCEPTED), merged as 27522d2.
• This promotion runs the full main gate: Typecheck + Unit Tests + E2E (linux+windows) + SpecGit Acceptance.

Closes#434#436#440#442#443 (already closed on merge of #444)