fix: align portable paths and upload validation

[suraciii]

Summary

• Change the default configuration directory from UserConfigDir/pages to UserConfigDir/.pages and update the CLI contract and user documentation.
• Close staged HTML files before validating rejected Uploads so Windows can remove the staging directory.
• Require canonical zip entry paths, reject case-insensitive duplicate names, and extract only after every entry passes validation.
• Accept only the documented Content-Type shapes: plain zip, and HTML with no parameter or only charset=utf-8.
• Keep install and remote Publish instructions shell-neutral, and update the design index for pages skill.

Verification

• make ci
• go test -race ./...
• Linux, macOS, and Windows builds
• Linux, macOS, and Windows test compilation
• Focused HTML rejection, Content-Type, and zip path tests
• Standard validation for the bootstrap and embedded skills
• Built pages skill output matches the embedded SKILL.md byte-for-byte