feat!: Validation contracts and package delivery were updated

[cmath10]

This completes the validation and package delivery changes after 0.2.1. Optional isShape fields now validate every present value, including explicit undefined, and public type inference follows the runtime guard/refinement stages.

Validation contracts

• Object-level shape.refine(...) is async-first; synchronous rules use shape.refine.sync(...).
• Public types were renamed without compatibility aliases, and built-in violations retain precise codes and arguments.
• Sequential refinements require a compatible preceding guard. Structural validators reset the assertion stage; extractor inputs and checker arguments are checked together.
• Added finite-number, integer, safe-integer, valid-date, Error, RegExp, and PromiseLike predicates/assertions, with corresponding JSON Schema mappings or explicit unsupported handling.
• English and Russian guides document the contracts and migration from 0.2.1. CHANGELOG remains generated from release commits rather than manual Unreleased notes.

Package delivery

• Fixed CommonJS shared chunk extensions and provided separate ESM/CommonJS declaration graphs for strict NodeNext consumers.
• Added packed-package checks for every public entrypoint, registry augmentation, type errors, and tree shaking.
• Moved repository-local skills to .agents/skills and updated agent instructions.
• Enabled runtime coverage by default, removed separate coverage recipes, and kept type-only checks from overwriting runtime reports.
• Updated development dependencies to Vite 8, Vitest 5, ESLint 10, commitlint 21, and compatible TypeScript 6.0.3; declaration generation uses unplugin-dts.
• Replaced on-demand standard-version execution with a local @modulify/conventional-release dependency and dry-run scripts.
• CI checks the code before preparing a release, atomically pushes its commit and tag, checks the exact tag before npm OIDC publication, and creates a GitHub Release afterward. Prereleases cannot publish to latest.
• The existing npm Trusted Publisher for modulify/validator / release.yml was verified. Workflow permissions grant id-token: write only to the publishing job.

Validation

• yarn lint, yarn typecheck, yarn test (235 tests with coverage enabled by default) and yarn test:d (52 type tests) passed. HTML, JSON and LCOV reports were generated; type-only tests preserved those reports.
• yarn test:package passed: build, packed ESM/CJS runtime consumers, strict NodeNext/Bundler consumers, and tree shaking.
• yarn install --immutable, commitlint for all branch commits, and make actionlint passed.
• Release branch/dist-tag validation passed seven scenarios.
• A real release in a disposable repository created version 0.3.0, its annotated tag, and a valid release commit; the lockfile remained unchanged. Stable and rc dry runs passed without mutations.
• Independent reviews found no remaining actionable issues. No package release was published.

BREAKING CHANGE: Object shape refinements are async-first, public type names were replaced, and sequential refinement pipelines require compatible guard stages. See docs/en/09-migration.md.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (13e6e3b) to head (f0703f7).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##              main        #5    +/-   ##
==========================================
  Coverage   100.00%   100.00%            
==========================================
  Files           11        11            
  Lines          736       851   +115     
  Branches       164       191    +27     
==========================================
+ Hits           736       851   +115     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.