xftp: all versions and old releases

Changelog
- 64b59ca: Place delta items by parent id, so files with an Office for the web link stay in the tree (@anderix)
- c5bac9c: README and the skill describe the REPL verbs with their aliases and the token-cache adoption as it works; SECURITY.md and .goreleaser.yml name build-release and the checksums.txt form; attribution headers (@anderix)

Changelog
- 803d5f8: Bind OneDrive for work or school URLs as well as sites and teams (@anderix)

- Take spauth v0.1.3, which seals the token cache on Linux and macOS too

- Take spauth v0.1.2, which seals the token cache
- Write xftp history 0600, as SECURITY.md says
- Remove author and AI-assistance attribution; it belongs in source file headers
- apt_repo, not apt_package
- Package versions stop coming from Dependabot
- Dependabot merges move to the organisation's sweep
- Packaging starts on the release rather than on the tag
- The profile is targets and names
- Retire the curl installer: apt, Homebrew, winget and cargo are the paths
- Dependabot: monthly, grouped, merged when every run on the commit is green
- Delete the Defender scan caller: the scan never predicted winget's validation
- Delete the release document: ship is the procedure
- Name a command that exists for the skill install
- Stop pegging the support window to a major version
- Regenerate the parameter block from ship.conf
- Rename release.conf to ship.conf
- Take the commands to smoke from release.conf
- Run the arm64 packages before anybody installs them
- Add release.conf, the parameter block a script can read
- Cover all three library-selection rules in the live suite
- Add a live test suite as the pre-release pass

Changelog
- 6fbe280: Add the bare auth command to every tool (@anderix)
- 4c707b9: Allow the dynamic Defender pass on demand (@anderix)
- 972ab68: Consume the SharePoint sign-in layer from excelano/spauth (@anderix)
- fd8b54e: Drop the release trigger from the Defender scan caller (@anderix)
- 467e33e: Pass the definition-rollback flag through (@anderix)
- 35ef667: Pin spauth v0.1.0 (@anderix)
- b57f39d: Scan released Windows artifacts with Defender (@anderix)
- 089190c: Share the token cache with xql at ~/.config/excelano (@anderix)
- f3d5a2c: Validate the release install with Defender before submitting to winget (@anderix)
- 58ab34d: Write the token cache atomically (@anderix)

Changelog
- 15d8a9a: Call the fleet's CodeQL scan instead of holding a copy of it (@anderix)
- 68506c3: xsync: a folder that already exists is the goal, not a failure (closes #7) (@anderix)

Changelog
- 5f33600: Install the Claude Code skill from any of the five binaries (@anderix)
- 2aacf83: Point the README at --install-skill, on every install channel (@anderix)