Prepare ChromaPaw 0.4.7 release candidate

[huanglianggit]

What changed

• add image- and intent-aware conversation-width decisions so supporting scenery keeps the normal Codex layout while showcase subjects can reserve side space;
• protect the current Codex header, system menu, navigation, task panels, notifications, and input surfaces with image-derived contrast-safe colors;
• harden reviewed Windows CSS monitor handoff during transactional refreshes;
• publish ChromaPaw as 0.4.7+codex.20260820094039 with updated schemas, documentation, and regression coverage;
• resolve the root plugin from the exact marketplace branch or tag instead of silently installing a nested main checkout;
• make clean-install smoke tests fail if the installed plugin version differs from the selected marketplace snapshot;
• add Code of Conduct, Support, CODEOWNERS, structured issue forms, a pull-request template, Dependabot, and GitHub maintainer guidance;
• pin GitHub Actions and the tested Codex CLI, use official npm registry lock URLs, and add a tag-gated workflow that validates, smoke-installs the exact tag, creates reproducible archives, generates an SPDX SBOM and checksums, and publishes a release.

Why

Earlier skin layouts inferred content width too directly from subject position, which could unnecessarily narrow conversations or allow important artwork to overlap text. The previous marketplace entry also fixed the plugin source to main, so an installation requested from a candidate branch or release tag could silently receive an older version. The repository additionally lacked several community, security, dependency, and reproducible-release surfaces expected of a project intended for public promotion.

User and developer impact

• Skin packages record and validate an explicit layout decision shared by previews and runtime CSS.
• Branch- and tag-selected marketplace installs now receive the matching ChromaPaw version.
• Existing activation and installation consent boundaries remain unchanged.
• Windows live activation remains experimental and exact-version gated.
• macOS live skin activation remains unsupported and is not claimed by this release candidate.
• Contributors receive structured reporting, review, support, and release paths.

Validation

• python scripts/release_check.py - 139 tests passed, 1 environment-dependent symlink test skipped
• Codex plugin validator - passed
• all three Codex skill validators - passed in Python UTF-8 mode
• isolated local marketplace installation - passed for 0.4.7+codex.20260820094039
• isolated GitHub candidate-branch installation - passed for the same exact version
• npm ci and audit against the official registry - 0 vulnerabilities
• GitHub CI on Ubuntu, Windows, macOS, Apple Silicon, and Intel - passed
• CodeQL for Python and JavaScript/TypeScript - passed
• repository YAML parsing, Markdown relative links, and git diff --check - passed

Release status

This remains a draft release-candidate PR. Do not create or push v0.4.7 until the PR is reviewed, merged to main, and the tag workflow has been intentionally authorized. Repository security features and the active main ruleset are configured; organization-wide 2FA remains intentionally unchanged for this phase.