release: prepare npm 0.3.1

[CodeinScrubs]

What changed

Prepare all 12 aligned @bidilens/* packages for the 0.3.1 patch release. This consumes the two reviewed Changesets, regenerates package changelogs and the bundled GitHub Action, aligns the private root/demo/citation metadata, and updates current-release documentation without claiming that npm publication has already happened.

Why

The fixes merged in #49, #52, and #53 are present on main, but npm consumers still receive 0.3.0. The installable 0.3.1 artifacts carry the direction-evidence correction for ordinary hyphenated and all-capital prose, the linear raw-math scanner, and bounded Unicode range writes. The same source release also records the repository-only hardening that keeps Unicode table generation offline against vendored, checksum-pinned inputs.

Developer impact

• All public packages remain fixed-version and ESM-only.
• No public API or production dependency changes are introduced by this versioning commit.
• The packed adapters retain the pure-LTR no-op contract.
• npm remains unchanged until a separate protected workflow receives an explicit human release decision.

Evidence

• pnpm run check: 401/401 tests, 932 cross-platform corpus cases, types, lint, docs, builds, and Action checks passed.
• Coverage: 92.03% statements, 86.01% branches, 94.78% functions, 94.86% lines.
• pnpm run test:visual: Chromium, Firefox, and WebKit snapshots passed.
• pnpm run packages:types: all 12 packed type/export layouts passed.
• pnpm run deps:audit: no known vulnerabilities.
• CycloneDX 1.7 SBOM validated: 580 components and 594 dependency relationships.
• pnpm run release:check: all 12 tarballs installed and executed in clean consumers; all packed examples passed; bundle budgets passed.
• pnpm run npm:release:dry-run -- --version 0.3.1: all 12 coordinates are unused and ready; no registry mutation occurred.
• The release-preparation workflow's post-merge Changesets context was simulated with changeset status --since HEAD and passed.

Security and language review

The release preserves source strings, selection/copy order, caller-owned alignment, strict hidden-control auditing, and offline runtime behavior. The 932-case corpus is technically reviewed or user-provided; it is not represented as native-speaker certification. Publication remains isolated behind the protected npm-release environment, OIDC trusted publishing, exact version matching, immutable-version rejection, provenance, and the exact human confirmation phrase.