chore: release CLI 0.1.5 integrations

[rare]

Summary

• sync the published @slidesfly/cli@0.1.5 runner and Skill 0.2.2
• update the GitHub Action, Claude, Cursor, and Gemini distribution packages
• set the public integrations release target to v0.3.3
• record verified npm registry integrity and independent tarball hashes
• upgrade patched example dependencies and keep exact fail-closed audit contracts for unresolved build-only advisories

Release evidence

• CLI npm version: 0.1.5
• npm integrity: sha512-X1xYq4fkMwPkLeWwWADocEZzZ6ezxf5p93ghbAJ5Y3AouPtHoMewX4TvKs99Ivm3xhDzzIiBk0aCRbIq4z1/Gg==
• npm tarball SHA-256: 9efe25aeabc1af33f3515880862167e27197f97f809e078271e28a07dbe263cf
• bundled runner SHA-256: fd4d1ce67f58960c20cbc12dcafdb888e0286a77f91264c2a0911becc9ff5b37

Security boundary

• Slidev was upgraded to 52.19.1; DOMPurify, js-yaml, and nanoid were advanced to patched versions.
• Marp's js-yaml and nanoid were advanced to patched versions.
• Upstream currently has no fix for two image-size advisories used through Slidev's PPTX export dependency and one extract-zip advisory used through Marp's browser export dependency.
• CI accepts only those exact three advisory URLs and exact vulnerability counts. Any advisory addition, removal, severity-count drift, or critical finding fails the build and requires review.

Verification

• workflow pin and OpenSSF validators
• GitHub Action fixture
• Claude, Cursor, and Gemini package validators
• Gemini CLI 0.53.0 extension validation
• npm release verifier for CLI 0.1.5 and MCP 0.1.0
• release attestation tests
• Reveal.js, open-slide, Slidev, and Marp builds
• reader bridge tests: 12 passed

Quarto is validated in CI with pinned Quarto 1.10.18.

[rare]

@codex review

[rare]

@codex review