Release v0.28.0: active timelines, app-created projects and client fixes

[renezander030]

This release fixes ignored edits in nested projects, adds compilation into projects created by CapCut, reduces agent command-discovery payloads, and fixes quoted Windows paths in the Python client. All release changes were consolidated in this PR; it supersedes #140.

• --active-timeline explicitly follows a validated Timelines/project.json pointer on unverified app builds. Invalid, deleted, symlinked or conflicting selected documents are refused. Root and active IDs are preserved, other timelines are untouched, and existing automatic selection remains the default. Library callers can use loadDraft(path, { activeTimeline: true }).
• compile --into <project> fills an empty app-created project while preserving each document's identity, app markers, unknown settings and shared store registration. Media copies and import registration use conflict checks, backups and rollback; changes during staging invalidate the empty-project check even with --force-write. Preview modes write nothing. Embedded timeline sidecars commit once, queue locks cover root/nested aliases, and restore commits active mirrors together.
• describe --compact provides a small index; repeated --command <name> returns selected complete contracts. The full v2 registry remains the default, and unrelated free-text arguments retain their behavior.
• Python client 0.1.3 fixes Windows quoting, escaped quotes, empty arguments and trailing backslashes, and forwards compact/filtered discovery. CI covers Linux, macOS and Windows with Python 3.9/3.14. English/Chinese guidance and command contracts are updated.

Validation: 1,134 CLI tests pass locally, with one platform-specific skip; 19 Python client tests pass. Lint, 52 focused safety/queue tests, npm installation smoke tests, actual FFmpeg-media shell compilation, Python wheel integration and twine check pass. All 13 checks in this PR's refreshed CI pass on a27bbed3889250a3a189dd21fd00c4ae2eea9315: CI run.

Published as one coordinated release after review and merge: npm capcut-cli@0.28.0, PyPI capcut==0.1.3 (wheel and source distribution), and GitHub v0.28.0 containing the CI-built Wasm component, checksum, license and third-party notices. All 13 post-merge CI checks pass on tagged commit cb348edce6c2c5f23fde9e34cd8759a5333d3442. Every public download matches its tested artifact; fresh public npm/Python installation and real FFmpeg shell-compilation checks pass. The Wasm component uses an external MCP host; this repository has no standalone MCP server package or public server endpoint to publish to the MCP Registry.

CapCut desktop acceptance for the new opt-in paths remains unverified. Create an empty project in the app, quit CapCut, check the compile plan, compile into it, then open/save/close/reopen to confirm persistence. #50 and #52 remain open for that acceptance check.