feat: release safe current-session review portability (v1.19.0)

[alloevil]

Summary

• Explicit current-session plaintext export with full JSON preview, no automatic raw logs/arguments/paths.
• Strict bounded import schema (1 MiB / 500 unique records), exact current identity/evidence matching, preview before writes.
• Never overwrite existing local slots; classify stale, unmatched, duplicate and conflicting records.
• Recheck storage on confirmation, invalidate changed previews, report partial write failures accurately.
• Preserve automatic diagnostics; no backend/dependencies/cloud sync. Version and claims synchronized.

Verification

• 233 Node tests passed, including 17 new transfer tests; 103 focused tests pass.
• Normal/demo builds, lint (existing findings unchanged), actionlint and 16 automated claims pass.
• Actual browser download + isolated-context/origin import, no-write preview, duplicate/conflict/stale skips, cross-tab invalidation, partial failure/retry, literal HTML note and narrow-screen checks pass.
• Static demo migration makes zero API requests. Staged secret scan passes; history finding is the pre-existing fake redaction fixture.
• Public usage, limits and receipt: docs/diagnostics.md and docs/diagnostics-verification.md.

Release

After required checks, release v1.19.0 through the existing Publish workflow; verify registry installation and Pages. Files are unencrypted human notes, not signed evidence or whole-history backup. Cross-tab atomic locking is not claimed.