chore(main): release patchloom 0.28.0 - #2151

## Summary

MPI cycle 2 (Test Auditor / Security / Adversarial).

- **PathGuard:** empty, whitespace-only, and format-char-only paths
(ZWSP/BOM) no longer resolve as the workspace root. New
`ContainmentError::EmptyPath` and shared `is_blank_path`.
- **MCP:** `FieldValidation::Path` / `PathEntry` reject blank paths with
`path must not be empty` before containment checks.
- **CLI/tx:** use the same blank-path helper (validate, engine stage,
global path rewrite, doc read).
- Multi-surface locks: cargo-bin `doc set` empty path + MCP `doc_set`
empty path.
- Stronger fuzzy replace score assertion (`[0,1]` and `> 0`).

## Test plan

- [x] `cargo test --lib --all-features` containment empty_path
- [x] `cargo test --test integration --all-features
test_doc_set_empty_path`
- [x] `cargo test --test integration --all-features
test_mcp_doc_set_empty_path`
- [x] `make check-fast` (pre-amend; re-run matrix in CI)

## Notes

Release PR #2151 (0.27.1) remains user-gated. Does not close #961 /
#1990.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

## Summary

Mark public `ContainmentError` as `#[non_exhaustive]` so additive
variants (including `EmptyPath` from #2152) do not require a major bump
every time.

## Release

Release-As: 0.28.0

This footer must stay in the squash commit body (release-please). After
merge, release-please should replace the open 0.27.1 PR (#2151) with a
0.28.0 release PR so `cargo-semver-checks` accepts the API shape change
vs published 0.27.0.

## Test plan

- [x] `cargo test --lib --all-features containment::`
- [ ] CI green

## Notes

Do not merge release PR #2151 (0.27.1); it is the wrong version for this
break.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

## Summary

Multi-perspective improve batch (session 2026-08-10):

- **QA:** Integration test that create/delete/append/prepend/rename
reject blank and whitespace-only paths with `error_kind: invalid_input`
(parity with read/doc/md).
- **Maintainer / End User:** `x-release-please-version` markers on
library embed snippets and portable zip `$ver`;
`release-please-config.json` `extra-files` so release PRs bump pins with
Cargo.toml (prevents red CI after the embed version smoke lock from
#2154).
- **Deps:** `rmcp` 3.1.1 → 3.1.2, `tree-sitter` 0.26.11 → 0.26.12.
- **Docs:** AGENTS.md notes markers + smoke test.

## Related

- Ref #2154 (embed lock that exposed release PR drift)
- Release PR #2151 already has manual 0.28.0 pin fix on the branch;
future releases should auto-bump

## Test plan

- [x] `cargo test --test integration --all-features
test_file_ops_blank_path`
- [x] `cargo test --test integration --all-features smoke_library_embed`
- [x] `cargo test --lib --all-features`
- [x] `cargo clippy --all-targets --all-features -- -D warnings`
- [x] `make check-fast`
- [ ] CI green

---------

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

## Summary

Curated `RELEASE_NOTES.md` for the upcoming **0.28.0** release
(blank-path
fail-closed, `ContainmentError` non_exhaustive, Windows install
honesty).

After merge, release PR #2151 can be merged to publish.

## Test plan

- [x] `make verify-release-notes`
- [ ] Merge then merge #2151

---------

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>