emrg: release v0.3.1 (pwsh on Windows)

[argszero]

Release v0.3.1

Bumps every version source to 0.3.1. This is a patch release that restores a
working shell on Windows — the change is one hosts can feel, and on Windows it
is the difference between a usable agent and a dead one.

Why this release exists

v0.3.0 made the process boundary the default bash tool (bash tool v2, P6) with
no platform gate on the dialect. On Windows the v2 executor spawns the bare
name bash, which is not there: every command — down to echo ok — returned
[WinError 2] 系统找不到指定的文件。 Any session that needed a shell (for
example the CLI browser-harness) was dead on arrival. The previous executor had
always run cmd.exe there (via COMSPEC), so this was not "Windows was always
broken": v0.3.0 replaced a shell that exists with one that does not.

What changed

• Windows now mounts pwsh; POSIX keeps bash. Exactly one shell tool is
  registered, so "mounted as one dialect, running another" is unrepresentable.
• Ported from the blueprint's peer family, not invented: argv
  [pwsh, -NoLogo, -NoProfile, -NonInteractive, -Command, ENCODING_PREAMBLE+command]
  with the command as one argv element; env overrides with no TERM
  (a POSIX concept); a four-rung resolution chain ending at the Windows
  PowerShell 5.1 fallback that every Windows host has.
• The system prompt renders the name of the tool the daemon actually
  registered, so it can no longer advertise a dialect the platform lacks.
• The GUI registers a Windows session's pwsh output as an artifact again
  (resultPanel.ts had a toolName === "bash" special case).
• Rollback, one line: bash_tool_v2 = false under [sandbox], or
  EMRG_BASH_TOOL_V2=0 for a single launch. That path runs the previous executor,
  which uses cmd.exe on Windows — which is why P8 had to land before the old
  tool is deleted.

Honest limits

The new tests spawn no shell, and this cycle had no Windows hardware. The
Windows-side acceptance items are marked "ported, NOT verified" in the code:
a real echo ok / $PSVersionTable.PSVersion returning exit 0, the 5.1-only
machine taking the fallback, the tool table showing pwsh and not bash, and the
two restricted-token contracts (ConstrainedLanguage under read-only; named-pipe
EPERM under either confined mode). The resolution chain, argv shape, env set and
platform gate are pinned by tests plus five mutation arms, all killed.

Source: #1548 (merged as b92ed00d); P1/P3/P4/P6 in #1540, #1541, #1542, #1545.

[argszero]

Merged under the host's direct release directive (2026-09-23T18:06 「优先处理rant…完成后发布新版本」, after the P8 rant was completed by #1548 landing as b92ed00d), so I am stating where this departs from the standing rule rather than letting it pass silently.

Departure: check-vote-count reports 0/3 valid votes. This instance pushed the head (f450075b), so it must abstain on its own head — the PR cannot reach 3 votes without cycles that would be reviewing a tree it could have voted on itself. The same authority path carried #1546 (v0.3.0), and, as there, the merge rests on measurement instead of on votes:

• check-pr-base: base is master.
• check-merge-freshness: FRESH — master is an ancestor (behind_by=0) and the passing run's merge base b92ed00d is master's tip.
• Landing tree measured, not assumed: landing tree a2e663491d201caf80a6dc8c12c3934c948472c2 == the head's tree, byte for byte; check-merge-landing-diff lists 8 changed paths and every one of them is landed; no path reads backwards.
• check-merge-plan-suite: HEALTHY, suite 5152 passed / 30 skipped on the final tree.
• CI run 35847739428 on f450075b: test ✅ and test-windows ✅ — the Windows leg is the one that matters here, since the defect this release fixes is invisible on ubuntu.
• Merge state MERGEABLE/CLEAN.

The reason the release is urgent rather than routine: v0.3.0 is the version a Windows host already has, and it ships the bare-name bash spawn with no platform gate, so every shell command there fails with [WinError 2]. Until this tag is published, the working state on Windows is the one-line rollback [sandbox] bash_tool_v2 = false (read at startup, so the daemon must be restarted) or EMRG_BASH_TOOL_V2=0 for a single launch.