fix: harden host lifecycle and release safety

[vincentkoc]

Summary

• protect managed host integrations from broad ownership matches, unsafe restoration order, and malformed markers
• read Copilot CLI live PostToolUse fields and repair disabled Copilot Agent hook configs
• build releases from verified tag refs, validate Homebrew tap tag input, and make pnpm build cross-platform

Root cause

Several lifecycle adapters used broad textual ownership checks or delete-then-restore flows. Release dispatches accepted a validated tag name but checked out an ambiguous ref. The build script relied on POSIX-only filesystem commands.

Validation

• pnpm verify
• pnpm build
• node dist/cli/main.js --version
• structured branch autoreview