xsync: all versions and old releases

Changelog
- 803d5f8: Bind OneDrive for work or school URLs as well as sites and teams (@anderix)

Breaking for unattended mirrors: xsync --delete with no terminal on stdin now refuses with exit 2 unless --yes (-y) is given. A cron job or script that mirrors with --delete needs --yes added. --dry-run --delete is unaffected.
Changed in xftp: rm -r <folder> deletes a folder without asking, in a terminal too. A plain rm on a folder still asks in a terminal and refuses with no terminal, and a piped session exits 1 if any command failed.
New: xcp prints the uploaded file's browser URL on stdout. xfind --url prints browser URLs in place of paths. xfind --search 'terms' queries SharePoint's search index, matching contents and metadata as well as names. The index trails uploads by many minutes. The Claude Code skill is rescoped and trimmed; run xcp --install-skill to refresh it.
Faster: a walk with no depth limit now fetches the whole tree in one delta query, so xfind, xtree and xsync's remote scan list a 320-folder tree in about 3 seconds instead of 43. Output is unchanged.
Fixed: on Linux, a token cache sealed while the login keyring was unlocked no longer reads as signed out once the keyring locks (graphauth v0.2.0, atrest v0.3.0).
Changelog
- 31ac496: Add xfind --search over the SharePoint search index (@anderix)
- 11abdd6: Give the search fixture a day to reach the index (@anderix)
- 04797c1: Guard unattended deletes and print browser URLs (@anderix)
- 9c33bd6: List an unlimited walk with one delta query (@anderix)
- 4a0c015: Live-test search against a fixture that outlives the run (@anderix)
- 79939d6: Remove ship.conf; the release apps read ship.toml (@anderix)
- 2793e5a: Rescope and trim the skill (@anderix)
- bbabce7: Retire the release workflows (@anderix)
- 996d3b7: Run CI by hand: workflow_dispatch instead of push and pull request (@anderix)
- 2a636d8: Stop counting and listing the commands in SECURITY and ADMINS (@anderix)
- 8277d39: Take graphauth v0.2.0 in place of spauth (@anderix)
- dd662eb: chore: refresh dependencies (@anderix)

- Take spauth v0.1.3, which seals the token cache on Linux and macOS too

- Take spauth v0.1.2, which seals the token cache
- Write xftp history 0600, as SECURITY.md says
- Remove author and AI-assistance attribution; it belongs in source file headers
- apt_repo, not apt_package
- Package versions stop coming from Dependabot
- Dependabot merges move to the organisation's sweep
- Packaging starts on the release rather than on the tag
- The profile is targets and names
- Retire the curl installer: apt, Homebrew, winget and cargo are the paths
- Dependabot: monthly, grouped, merged when every run on the commit is green
- Delete the Defender scan caller: the scan never predicted winget's validation
- Delete the release document: ship is the procedure
- Name a command that exists for the skill install
- Stop pegging the support window to a major version
- Regenerate the parameter block from ship.conf
- Rename release.conf to ship.conf
- Take the commands to smoke from release.conf
- Run the arm64 packages before anybody installs them
- Add release.conf, the parameter block a script can read
- Cover all three library-selection rules in the live suite
- Add a live test suite as the pre-release pass

Changelog
- 6fbe280: Add the bare auth command to every tool (@anderix)
- 4c707b9: Allow the dynamic Defender pass on demand (@anderix)
- 972ab68: Consume the SharePoint sign-in layer from excelano/spauth (@anderix)
- fd8b54e: Drop the release trigger from the Defender scan caller (@anderix)
- 467e33e: Pass the definition-rollback flag through (@anderix)
- 35ef667: Pin spauth v0.1.0 (@anderix)
- b57f39d: Scan released Windows artifacts with Defender (@anderix)
- 089190c: Share the token cache with xql at ~/.config/excelano (@anderix)
- f3d5a2c: Validate the release install with Defender before submitting to winget (@anderix)
- 58ab34d: Write the token cache atomically (@anderix)

Changelog
- 5f33600: Install the Claude Code skill from any of the five binaries (@anderix)
- 2aacf83: Point the README at --install-skill, on every install channel (@anderix)