Merge the v0.3.1 maintenance line into main and release 0.3.2

[AetherAI3]

v0.3.1 was released from codex/patch-release-031, a branch that never merged. main went on without it, so two things were true at once: the registry served 0.3.1 while main declared 0.3.0, and main was missing code that shipped to users.

The missing code is not cosmetic

openTargetChecked and openBrowserAwaitLaunch were absent from main, and main's openBrowserChecked was a synchronous wrapper that returned the launch plan without waiting for the OS launcher to start or fail:

/** Same launch, but with the outcome so a caller can report a refusal. */
export function openBrowserChecked(url: string): OpenOutcome {
  return openTarget(url);   // reports only that a spawn was attempted
}

On a machine with no browser, aether auth login reported a launch it had only attempted. This merge restores the fix and the async login path that uses it, plus the maintenance line's release guards in ci.yml, release.yml, release-truth.yml, and verify-production.ts.

Conflicts, resolved deliberately

File	Resolution
README.md, test/login.test.ts	kept main's rebuilt copies — the 0.3.1 side was the older front door
src/commands/login.ts	took the 0.3.1 side, because that side is the fix
package.json, src/main.ts	reconciled by hand

0.3.2

Version bumped across package.json, package-lock.json, src/version.ts, the README rows and source-scope banner, and the PyPI launcher via packages/sync-version.mjs.

Patch, not minor: this candidate publishes no command, flag, or contract of its own. The device-runtime, telemetry, and session-library work already on main is carried by the merge and deliberately not announced here — whichever release announces it should take the next minor number.

Release record

Declaring a version obliges the record that goes with it, so this also adds:

• docs/releases/OPERATOR-PACKET-v0.3.2.md with measured evidence — 1,387,500 packed bytes, 4,461,548 unpacked, 673 entries, shasum 3e22664f…, from a local npm pack --dry-run against this tree
• the RELEASE_NOTES.md entry, docs/releases/2026-09-03.md, and its index row
• V031_PACKET → V032_PACKET in release_coherence.test.ts, the constant the suite checks the packet against

Why it will not silently recur

v0.3.1 is now an ancestor of main, so the next occurrence is visible to git merge-base --is-ancestor rather than only to whoever compares the registry against package.json by hand.

Local: the release-coherence, public-docs-truth, opener, login, main-entrypoint, and production-hardening suites pass (58 tests), as do the 29 PyPI launcher tests. Full-suite verification is CI's.

🤖 Generated with Claude Code