release: prepare Evidrift v0.3.3

[bm1016bm-svg]

What changed

• make the English and Traditional Chinese READMEs lead with verified support boundaries, a real architecture flow, and a copy-pasteable CI adoption path
• add a complete read-only, lockfile-based GitHub Actions guide with commit-pinned Actions
• expand project CI to Linux and Windows on Node.js 22 and 24
• canonicalize both sides of storage containment checks so Windows runner junctions do not cause false repository-escape reports
• add regression tests for the public documentation contract, CI matrix, and aliased repository roots
• align package, lockfile, CLI, website, and MCP Registry metadata at v0.3.3
• replace the network-dependent “10 seconds” promise with a reproducible one-command claim

Why

Evidrift already had a real CLI/MCP implementation, captured demo, release automation, security policy, license, and acceptance suite. The main gap was discoverability: architecture and adoption details were buried, the CI gate only exercised Linux, and the first-run copy made an unverifiable timing promise.

The first cross-platform CI run then exposed a real Windows runner difference: the temporary repository can be reached through an alias or junction. Storage checks compared the unresolved root with a canonical evidence path and falsely reported an escape. Both paths are now canonicalized before the same containment check, while external links remain rejected.

Validation

• npm run verify: 63 passed, 0 failed, 0 skipped
• focused core and MCP tests: 26 passed
• npm run release:check -- v0.3.3
• end-to-end smoke test: baseline PASS and deterministic signature-drift FAIL
• repository Receipt check: PASS
• isolated tarball install: --version, bare onboarding, init, and demo passed
• package: 64 entries; 58,425 packed bytes; 256,600 unpacked bytes
• tarball SHA-256: cc3a95f7637d61cfdcefed76d0dbc7077141a1a3206a52d9a9ffb4049d5aef91

Release impact

This prepares v0.3.3. It does not change the Receipt schema, verification policy, network access, cloud behavior, or runtime-correctness claims.