Prepare Spotter 1.8.0 with Grok audit hooks and Windows fixes

[quolu]

Summary

• Accept a leading UTF-8 BOM in hook JSON and allow the read-only Codex auditor to run in non-Git projects.
• Add Grok Build native audit hooks and a host-local catalog. Keep Grok's compatibility hook events out of the Claude audit path.
• Complete Grok catalog refresh before the first prompt audit on Windows. Use SessionEnd to finish a headless turn when Stop omits its final response.
• Remove the retired FOX WSL2 dashboard device and update the current product documentation for the three-device layout.
• Prepare the 1.8.0 package and changelog.
• Add a manual GitHub Actions publishing workflow using npm trusted publishing (OIDC); no stored npm publish token is needed after one-time npm package setup.

Verification

• npm test: 605 tests, 602 passed, 3 platform skips, 0 failures.
• npm run verify:docs: passed.
• npm pack --dry-run: claude-spotter-1.8.0.tgz, 107 files.
• The release workflow verifies the requested version and requires the commit to be on origin/main before publishing.
• Linux, macOS, and Windows native: staged package and live Claude Code, Codex, Cursor, and Grok sessions verified. Grok loaded 88, 171, and 87 catalog entries respectively and completed prompt and response audits on all three systems.

Grok 1.0.41 does not deliver passive-hook stdout to its conversation. Findings are stored in structured hook events and the evaluation database. Conversation display remains an open issue.