Fix home-folder chat stall in v0.3.3 maintenance candidate

[AetherAI3]

Summary

Prepare a narrow v0.3.3 maintenance candidate from the published v0.3.2 tree on release/0.3. Interactive chat started in a broad Windows home directory can spend too long scanning nested instructions before making its cloud request. This backports the bounded scan and makes an incomplete scan visible; local tool authority remains closed when the scan is incomplete. A 401 response whose body never finishes now returns a finite, classified HTTP 401 with the sign-in hint, and refresh response bodies have a finite bound.

Release scope

• Bump npm and PyPI launcher versions to 0.3.3 and add a matching operator packet/release notes.
• Refresh the public model projection from the authoritative cloud endpoint (schema aether-cloud/public-model-projection@1, 59 rows, digest sha256:f4601f14ac7829b51e95d92abc1631c74097fa193bc566151a2161c5a799ba7f) and regenerate derived docs. The previous snapshot had aged beyond the 30-day release gate.
• Enable release/0.3 PR CI and release-truth checks. Add a packed installed-CLI smoke on Windows and Linux: 2,100-folder synthetic home, successful chat, held-body 401, sign-in hint, and a distinct queued prompt that succeeds afterward.
• No 0.4 PC capability changes, npm publication, or release tag are included.

Local evidence

• npm run build
• npm run docs:check
• Focused suite: 90/90 tests passed (auth, instruction resolver, generated docs, public docs, release truth and coherence)
• PyPI launcher unit tests: 29/29 passed; version sync check passed
• npm run smoke:packed-home passed against the installed tarball
• npm run verify:production passed for 0.3.3 (673 packed files)
• npm run release:truth passed 12/12 checks (one earlier transient npm registry timeout cleared on retry)
• Live-wire regressions: missing/blank msg plus done now fails a one-shot command; only known fixed public media strings from the alternate error field are displayed. Arbitrary error and reason text stay hidden. The installed-tarball smoke exercises all three shapes.

The broad local npm test run was inconclusive under this Windows host's load. The isolated Job Object test passed on both this candidate and the unchanged v0.3.2 baseline. Exact-head hosted Windows and Ubuntu CI are required before merge. A real Windows account canary and the protected publication gates remain separate release decisions.

Live canary blocker

The first packed-candidate run from a real Windows home directory proved the instruction scan no longer stalls, but Cloud returned a media-studio error for the plain chat prompt. The CLI previously hid that fixed public error text and exited zero; this PR now shows the allowlisted text and exits nonzero. Cloud currently routes on the whole brief, including home CLAUDE.md media headings, rather than the actual <task> text. Cloud routing PR AETHER-CLOUD #1854 must land and deploy, then the real home-folder reply-1 canary must pass before v0.3.3 is publishable.