feat: publish Spawnfile 0.1.14 ecosystem integration

[apresmoi]

What changed

• Publishes the current Spawnfile compiler, target lifecycle, world authority, causal evidence, runtime, and Simfile-composition stack as one reviewable commit.
• Prepares spawnfile@0.1.14 with registry dependencies: @noopolis/stele@0.0.2 and @noopolis/mneme@^0.1.1 for development tests.
• Pins Moltnet v0.1.14 release authority and downloads the exact Linux amd64/arm64 asset on demand, verifying SHA-256 before extraction.
• Removes implicit sibling-checkout defaults, the bundled Stele tarball, cross-repository source-import tests, and point-in-time research/audit documents.
• Keeps local Moltnet release directories as an explicit offline/development override only.
• Updates the documentation site to audited Astro 7 / Starlight 0.41 / Sharp 0.35 dependencies.

Deployment contract

• The npm tarball contains no bundled dependency, vendor archive, or ecosystem source checkout.
• A fresh install resolves Stele from npm and can import the package and run the CLI.
• A fresh installed package stages executable Moltnet v0.1.14 binaries for both Linux architectures from the GitHub release, with the checked-in revision and digests.
• Publish CI runs the production vulnerability audit and isolated package-closure verifier before npm publish.
• Website deployment now audits production dependencies before syncing the static build to both S3-backed domains.
• Runtime-image CI builds OpenClaw and PicoClaw for both linux/amd64 and linux/arm64; tag publication remains gated by Docker Hub credentials.

Validation

• npm ci --ignore-scripts — pass
• npm audit --omit=dev --audit-level=high — 0 vulnerabilities
• npm run typecheck — pass
• npm run build — pass
• npm test — 2,936/2,936 Vitest cases and 12/12 Node cases pass
• coverage — branches 90.38%, functions 97.94%, lines/statements 95.81%
• npm run verify:package-closure — pass, including both verified Moltnet architectures
• website clean Linux install, production audit, 27-page build, sitemap/search generation, and 41-route crawl — pass
• OpenClaw and PicoClaw multi-architecture PR image builds — pass
• workflow YAML, dependency tree, and git diff --check — pass

Review notes

• The former 301-commit synchronization history was replaced with one commit on current main.
• Local development worktrees and generated run evidence are not part of this PR.