fix: v0.2 final review wave

Transcriptions Yaegi coverage via integration mock, flattened admin
usage batch, hardened CSP, sanitized provider lastErr, source-archive
prefix template, vendor export-ignore warning, release paths.

.github/workflows/release.yml

@@ -8,6 +8,11 @@ on:
       - "**.go"
       - "go.mod"
       - "go.sum"
+      - ".goreleaser.yaml"
+      - ".gitattributes"
+      - ".traefik.yml"
+      - "version.go"
+      - "workflow-prepare.sh"
   workflow_dispatch:
 
 permissions: