Update the Herdr fork and publish versioned release binaries

[Unique-Divine]

Update the Herdr fork and publish versioned release binaries

Update the vendored Herdr fork, preserve mobile pane controls and Codex session behavior, and add tagged release builds so installations can use verified binaries instead of compiling locally. This PR includes the pending dotfiles changes for Git branch helpers, ShareX discovery, and Codex defaults.

Rationale

The custom Herdr binary needs its own release path because upstream downloads replace the fork's behavior. Dotfiles owns the vendored source, build workflow, and release installation commands. Fork tags match the Cargo version, while provenance records the upstream base separately.

Key Changes

1. Vendor upstream Herdr v0.9.3 with local behavior preserved, separate its source from managed configuration, and prepare fork version 0.9.4.
2. Bind literal underscore for mobile pane equalization and configure Codex scrollback, session restoration, and managed starts without daemon reuse.
3. Publish five platform assets from tags matching herdr-ud/vX.Y.Z, with ConPTY packaging on Windows, checksums, and source provenance.
4. Extend command just herdr-install with verified release installation and XDG cache downloads. No arguments and --ver source retain source installation.
5. Move Git branch helpers into PATH commands, resolve ShareX Documents paths dynamically, and update Codex model defaults and trust configuration.
6. Align CI with Bun 1.3.14 and exclude the upstream publishing-workflow test whose files are absent from this fork.

1 - Release and installation behavior

scoped tag -> locked Rust builds -> verified draft assets -> published release
--get VERSION -> verified XDG cache -> runnable binary path
--ver VERSION -> verified cache -> atomic replacement of ~/.local/bin/herdr

Published assets cannot be overwritten by workflow retries. Cached downloads are checked before reuse, and failed installation checks preserve the existing executable. Fixture coverage uses a local HTTP server and temporary homes, so it exercises download and installation without publishing or replacing the user's binary.

The built-in command herdr update still downloads upstream releases. Redirecting it is separate work. Installation does not restart running sessions.