fix: recover failing CI checks

[code-yeongyu]

What was failing

• Publish Model Catalog. The publish job inherits R2 credentials this repository does not define, so every scheduled run failed at upload while generation and checking were healthy. Now gated on vars.PI_MODEL_CATALOG_PUBLISH; generation and the catalog check stay unconditional.
• valid-cwd-guard. On macOS the ESM loader wedges when a dynamic import starts after the cwd is unlinked, so the child hung and the unbounded spawnSync blocked Vitest's own timeout. recoverValidCwd() is now exported and the test links both modules while the directory is still valid.
• cursor-cli-oauth/shutdown. The fixture publishes its pid file with rename(2) before its first stdout event, so fs.watch never fires when the file already exists by the time the watcher is installed.

Verification

• npx vitest --run test/valid-cwd-guard.test.ts test/cursor-cli-oauth/shutdown.test.ts — 11/11.
• Full npm test at repo root — exit 0.
• actionlint clean on all workflows.

---

Summary by cubic

Recovers failing CI by gating model-catalog publishing and fixing two test hangs on macOS. Previously, the publish job always ran and failed with missing R2 credentials; now it runs only when vars.PI_MODEL_CATALOG_PUBLISH is true, while generation and validation stay unconditional.

• Publishing: Set vars.PI_MODEL_CATALOG_PUBLISH='true' and configure PI_ARTIFACTS_R2_* secrets to re-enable uploads; otherwise only generate and validate the catalog.
• Valid CWD guard: Export recoverValidCwd() (still invoked at module load) so callers can recover after the cwd is deleted; tests preload modules to avoid macOS ESM loader wedging and add a 30s timeout backstop.
• PID watcher: Read the pid file if it already exists and handle both “change” and “rename” events to avoid missing the publish event.

^{Written for commit 76bcae7. Summary will update on new commits.}

[code-yeongyu]

Superseded by #1048.

While this PR was in flight, main landed an equivalent guard for the cursor-CLI shutdown
pid-file race. #1048 is rebased onto 20cd958c0 and reduced to the two fixes main still
lacks: the model-catalog publish opt-in gate and the exported deleted-cwd guard.
Verified there at 11 passed / 0 failed, actionlint clean.