chore(release): prepare v0.19.0 - #2735

What changed

Prepare Bashkit 0.19.0 across Rust, Python, native JavaScript, browser WebAssembly, CLI, and C ABI distribution. Release notes cover all 279 merged PRs since 0.18.2, including terminals, sandboxed CPython, shell/coreutils compatibility, and resource/dependency hardening. Document the ScriptedTool package/import migration and refresh generated TypeScript API references.

Python now derives bashkit.__version__ from the native runtime, keeping public package, native API, and installed distribution metadata consistent.

Fix release preflight to verify all four exact crate archives together. Cargo's temporary registry supports unpublished internal dependencies, replacing the older-core packaging proxy. Homebrew release metadata now uses the workspace MIT license and required human commit identity.

Why

Publish the accumulated features and fixes through the established tag-driven release workflows. The new CPython and ScriptedTool crates have never been published; a standalone core dry-run cannot resolve that new dependency graph.

Before / After

• Published versions remain 0.18.2 before merge; the candidate reports bashkit 0.19.0.
• Before: standalone core dry-run fails with no matching package named bashkit-cpython-wasm found.
• After: the four-package dry-run packages and verifies every exact 0.19.0 crate, then suppresses all uploads. CPython archive: 8,159,856 bytes (<10 MiB).
• CLI smoke: pipeline beta, jq sum 6, rootfs-ok. Native JS imports, execution, and terminal interaction pass.
• Python version regression: fails before (0.1.2 vs 0.19.0), passes after. Focused installed-package, terminal, and runtime tests: 59 passed, 2 optional-framework skips; Ruff lint/format pass.
• Native JS: 593 tests pass. Browser release package: 72 tests pass. Feature-sliced Rust and failpoint suites pass; all-feature clippy passes. just pre-pr passes, including cargo-vet. All three recent fuzz runs are green; the last three nightly runs and last three fuzz runs are green. Final-head CI and every release-PR check passed.

Risk

• Medium: this release contains a broad feature cycle and intentional Rust ScriptedTool API moves; migration instructions are in the changelog and guide.
• Publication remains dependency-ordered; release workflows verify registries and shipped packages. Post-merge monitoring will verify exact source, assets, registries, and consumer smoke tests.

Checklist

• Tests added or updated (preflight regression failed before the fix; 162 script tests pass)
• Backward compatibility considered (0.19 minor release and explicit migration guide)