The previous path-based comparison used a hardcoded /posts/{slug} prefix
that never matched the actual /pub/{rkey}/{slug} paths stored in PDS records,
causing all documents to appear as unmatched in sync output.

The previous path-based comparison used a hardcoded /posts/{slug} prefix
that never matched the actual /pub/{rkey}/{slug} paths stored in PDS records,
causing all existing notes to be treated as unmatched and deleted whenever
a new note was published.

Replace path-based document addressing with a stable canonical path
tied to the ATProto record key. New records are created with a
placeholder path, then immediately updated via putRecord with the
final /pub/{rkey}/{slug} path.

- Remove pathPrefix and pathTemplate config options
- Remove resolvePostPath() and resolvePathTemplate() from markdown.ts
- createDocument() always makes 2 API calls (create + putRecord)
- updateDocument() builds path from parsed rkey
- sync and publish commands switch to atUri-based record matching

- Update test expecting a throw on missing frontmatter to match current
behavior (returns defaults)
- Fix invalid TOML in +++ delimiter test (quote strings and date)

Adds support for the `discoverable` boolean field on `space.remanso.note`
records. Defaults to true when not set or invalid; can be set to false
via frontmatter to hide a note from discovery feeds.

Build the canonicalUrl after record creation so the rkey is available,
producing the correct format: https://remanso.space/pub/{did}/{rkey}/{slug}.
Extracts slugifyTitle as a shared utility and adds canonicalUrlBuilder
to PublisherConfig for per-publisher URL customization.

- Fix ../ relative path normalization in resolveInternalLinks and
findPostsWithStaleLinks (packages/cli/src/extensions/remanso.ts)
- Add packages/remanso: new CLI binary (remanso-cli npm package, remanso
command) with auth, init, publish, sync, and github commands
- publish: two-pass flow (site.standard.document + space.remanso.note),
.pub.md filter, siteUrl derived from agent DID, app-password only
- sync: matches .pub.md files to PDS documents, preserves note field comparison
- init: interactive wizard with GitHub remote detection, credential setup,
publication create/select, .gitignore, workflow generation, gh secret setup
- github: generates remanso-space/sequoia@main workflow YAML, sets secrets via gh CLI
- Update action.yml to build and link remanso CLI instead of sequoia CLI
- Add build:remanso and dev:remanso scripts to root package.json

Extend the PDS comparison in sync to cover title, description, tags, and
note-specific fields (theme, fontSize, fontFamily) in addition to body
text. Previously, changing only frontmatter and running sync would store
the current file hash, causing publish to skip the update.

The comparison logic is extracted into a matchesPDS helper for clarity.

Skip bun install and build when bun.lock and source files haven't
changed, avoiding re-downloading 428MB of deps on every run.

Unquoted `**/*.md` was shell-expanded (bash globstar is off by
default), only matching one level deep. Quoting it passes the
pattern as a git pathspec, which recurses at any depth.

When a post's state entry is missing but its frontmatter already
contains an atUri, use "update" instead of "create" to preserve
the existing rkey and avoid duplicate records.

Add unit tests for markdown.ts and make frontmatter optional: parseFrontmatter
now extracts title from headings when no frontmatter is present,
and updateFrontmatterWithAtUri creates a new frontmatter block when none exists.

Upload local images as blobs and replace paths with CIDs in markdown content.
Remove links to unpublished notes to avoid dangling references.

github.action_repository/ref inside a composite action resolve to the
current step's action (actions/checkout), not the parent composite
action. Use github.action_path which points to the already-downloaded
action source.

The state file is rebuilt from the PDS by `sequoia sync` on every run,
so committing it is unnecessary and caused failures when .gitignore
blocked the `git add`.

The CLI uses crypto.subtle in getContentHash() but relied on the
Bun-global crypto object. This fails in Node.js environments (e.g.
GitHub Actions). Explicitly importing from node:crypto works in both.