Harden validation and add cloud CI

[Eldorado-ling]

What changed

• keep OpenCode skill metadata within the discovery limit
• accept current and legacy OpenCode share URL forms
• fail closed on malformed inbox paths, trust settings, repo mismatches, and Git command failures
• add command timeouts and correct threat-model wording
• add standard-library unit and real local Git inbox integration tests
• add Linux/Windows GitHub Actions coverage for Python 3.8 and 3.13

Why

The original v1.0.1 had no automated tests or CI, its skill description exceeded OpenCode's documented limit, and several malformed-input and failure cases were not rejected deterministically.

Validation

• python -m unittest discover -s tests -v (17 tests)
• python -m py_compile verify_inbox.py tests/test_verify_inbox.py
• skill quick validation
• OpenCode 1.17.13 discovery check

This is a draft PR created to validate the candidate in GitHub Actions before any merge or release.

[Eldorado-ling]

Cloud validation passed for commit 2226e3d:

• Ubuntu: Python 3.8 ✅, Python 3.13 ✅
• Windows: Python 3.8 ✅, Python 3.13 ✅
• 17 tests per job, including a real temporary Git inbox pipeline
• py_compile passed in every job
• live GitHub commit API check passed: Tier 4 author/committer attribution ✅ and Tier 5 signature verification ✅

Run: https://github.com/Eldorado-ling/opencode-handoff-p2p/actions/runs/29149781331

Not covered by this automated run: fetching a real private OpenCode share transcript and a two-account collaborator handoff.