chore(release): prepare v0.0.43

[ackness]

Summary

Prepare v0.0.43 from the reviewed changes since v0.0.42 (#91, #92, #93). Align all 19 framework manifests, refresh the English and Chinese README version notices, and document native Gemini support, provider request contracts, prepared execution commits, atomic vector indexing, plugin-panel fixes, and CI/pre-push verification.

The release review also found a false-positive path in the live three-round acceptance test: selecting a guide suggestion only prepared a draft, but the test could count the previous idle turn as a new round. The test now explicitly sends the third action, waits for execution to start, and checks a guide block attached to the current, distinct turn instead of matching arbitrary historical cards.

Change type

• Release preparation / documentation
• Test correction

Verification

• pnpm check — passed, including workspace TypeScript checks, boundaries, dependency/import hygiene, manifests, i18n, script tests, and actionlint.
• pnpm test --concurrency=2 — 46 tasks passed; 7,793 Vitest tests plus desktop checks.
• pnpm test:pg — 961 Store tests and 24 server integration tests passed against an isolated PostgreSQL 18 / pgvector 0.8.6 container.
• pnpm e2e — 118 passed; 6 opt-in provider-backed tests skipped in this deterministic run.
• pnpm e2e:extensions — the isolated third-party stage/browser acceptance passed.
• pnpm release:preflight — passed.
• pnpm --filter @covel/desktop build — passed, including staged resource and Electron-Node boot checks.
• pnpm --filter @covel/desktop smoke:restart — passed with real Electron IPC, preload version, and navigation to a new backend port.
• Limited live acceptance against the staged production server and Web build using the existing DeepSeek deepseek-flash configuration — character creation, sequential turns, refresh, narrow layout, preserved characters/messages/game state after server restart, and one additional committed turn passed in isolated SQLite storage. Browser settings were restored from browser storage; this does not claim full Electron settings persistence or an interactive Windows playthrough.
• Local desktop staging rebuilt explicitly with NODE_ENV=production; production-only UI gates and all seven Mistport portraits verified. The direct server harness supplies the media signing secret that the Electron shell normally creates.
• Ego Lite real-browser acceptance with isolated SQLite data and the existing DeepSeek configuration: onboarding/model connection, invalid and valid character creation, refresh during generation, guide/free-text turns, explicit stop/reload/retry with unchanged committed records, 390px composer/sidebar interaction, and restart preserving characters/messages/game state/settings passed. Third-party ZIP installation, duplicate rejection, denial/approval, uninstall/restart, reinstall/re-authorization and continued play passed in the same existing session (five committed player turns, 34 unique messages). Ego Lite screenshot capture timed out in this environment; DOM interactions, loaded-image checks and layout bounds were verified, without claiming a screenshot-based visual review.
• Corrected live three-round spec — both tests passed against the staged production build (41 seconds).
• PR CI — all jobs passed.
• Build Desktop candidate run — all verification gates, macOS arm64 and Windows x64 packaging, staged-resource validation, and the Windows package-installation regression passed for commit 956da528051b77dce59a95fb587436cdcd8e9684. This run used publish_release=false; the publish job was skipped.

Documentation and compatibility

• Changelog and both README current-version notices updated.
• Framework manifests aligned; plugin/world versions remain independent.
• Breaking host/plugin contracts and affected development session/index recreation documented. Checkpoints omit derived vector progress and rebuild indexes on restore.
• Unsigned macOS Apple Silicon / Windows x64 artifacts and lack of macOS notarization disclosed.
• No onboarding tutorial change, so its version remains unchanged.

No release tag or GitHub Release is created by this PR. Candidate CI and the Build Desktop dry run have passed. Merge review and tagging remain separate release steps. Native Gemini received contract/unit/browser-configuration coverage; the limited live provider run used DeepSeek.