Parameter extraction: take: param in forge unify, ingredient param defaults

[llima]

Summary

• Version bumped to 0.5.0 (minor). Merging publishes craftar@0.5.0 to npm after approval in the npm environment.
• Parameter extraction (M1 slice 5, spec 09): a forge unify plan hunk may be take: param. Each listed token becomes {{key}} in the base, the base's text is declared as the key's default in its ingredient.yaml, and the variant's text goes into the variant profile's profile.yaml params — only after an equivalence proof shows both sides render back exactly, and only when the same plan resolves the variant. --save-plan pre-fills params for value hunks.
• New resolve layer: an ingredient's declared params defaults are the weakest layer, scoped to that ingredient (paramsFor).
• Twenty refusals (P1–P20), all with the Forge untouched: unpairable hunks, uncovered or whitespace-only differences, placeholder changes, conflicting values, reserved keys, a variant another profile uses, a key another recipe/profile/ingredient already sets or cites, files a target copies raw, hand-formatted or aliased YAML. The profile file joins the held-by-git set and the late-failure recovery.
• Fix: substitute resolves own properties only — {{constructor}}, {{toString}}, {{__proto__}} no longer render built-in JavaScript members.

Emitted bytes — which workspaces see a change

• Only a workspace whose body contains {{constructor}}, {{toString}}, {{__proto__}} (or another Object.prototype name) sees update: that placeholder now stays literal (commit 8e259be, user-approved).
• No other byte moves: no Forge that loads under 0.4.0 can hold ingredient params, so paramsFor returns exactly the old params map. Old goldens (forge-unify, acme-portal, acme-web) are unchanged.
• After an extraction, workspaces on either profile render exactly what they rendered before (the two-profile proof below).

Upgrade note

README § Upgrading → to 0.5.0: a Forge edited with take: param needs 0.5.0 in every workspace that syncs it (0.4.0 refuses ingredient params); import is not template-aware yet (re-importing over an extracted base creates a variant and drops the profile's params — unify warns, W2); the substitute fix above.

Test plan

• npm run typecheck — passes
• npm run build — passes
• npx vitest run --exclude test/ci.test.ts (Linux) — 445 passed / 5 skipped
• New golden Forge test/golden/forge-param (LF, and CRLF + BOM) reproduces its expected tree; a fresh --save-plan reproduces the committed plans
• Two-profile sync proof: acme and globex workspaces synced before, every file unchanged byte for byte after both extractions across claude-code, kiro and agents-md; negative control without the profile values shows update
• Oracle skipped — no fixture on this machine (not using a client workspace); the two-profile proof is the evidence for the new behaviour
• CI green on Linux and Windows (Windows not run locally; the late-failure test is skipIf(win32 || root))
• node-cli-reviewer and docs-author: clean after two correction rounds (reuse case refused by P16, mixed reused+literal key skipping P15/P16, --json written/params, profile lookup by real directory, emitter regexes shared, missing refusal tests)
• Deferred nits: core imports the text-extension regexes from the emitters; the line-level whitespace message is skipped on lines with a reused key (the file-level proof still refuses); the — already in place text marker has no test of its own