feat(v0.7.42): ship repository evidence plugin and remote query support

[qiansc]

Summary

• Prepare the 0.7.42 release across workspace packages and parser coordinates.
• Support remote-first approved knowledge retrieval without requiring a local checkout, while retaining local and non-MCP paths.
• Bundle a repository-scoped evidence Wasm plugin for read/read_many, returning section references and fixed-commit source URLs when available.
• Add safe installation and upgrade through context evidence install; preserve unknown files and defer ambiguous nested roots.
• Reuse attached evidence and ready citations without redundant registry lookups. Registered references are not treated as verified source reads.

Validation

• Workspace build, typecheck and lint passed (existing lint warnings remain).
• Node extractor smoke checks and bundled CLI contract tests passed.
• Actual npm tarball evidence installation passed under Node with Rust and Git unavailable on PATH; repeat installation is unchanged.
• Default tests passed: 1,982 Bun tests and 20 Node tests (including 18 real Wasm cases), zero failures.
• Full-only integration tests passed: 39 tests, zero failures (50.54 seconds).
• All 13 public package dist archives passed pack auditing at version 0.7.42.

Release

• Publish public packages only through the GitHub Release/OIDC workflow after merge.
• The new build step needs Rust 1.89.0 and wasm32-unknown-unknown; CI provisions both. End users need neither Rust nor Git to install the bundled plugin.