release: 5.0.0-beta

CI / infra:
  - Replace azure-pipelines with GitHub Actions (build-asset.yml)
  - Build and publish pre-built assets for windows-x64, mac-arm64,
    linux-x64, and linux-x64-musl on tag push
  - Remove EOL Node 18 and 20 from build matrix; default to lts/*, 22, 24

  Bug fixes:
  - fix: _assembleDeliverable deadlock — bundle.finalize() must be called
    before MultiStream starts consuming; calling it in the Transform's
    first-chunk callback deadlocked because archiver never emits without
    finalize, so the sentinel and trailers were never written
  - fix: ESM realpathSync ENOENT on Node 22.22+ / Node 24 — these versions
    removed the ENOENT catch in finalizeResolution; VFS paths don't exist
    on real FS so binding.lstat throws. Two-pronged fix:
    (1) boot-nexe.ts: install ENOENT-tolerant wrapper before _compile()
    (2) shim.ts: re-apply wrapper after shimFs() overwrites boot-nexe's
        patch, so the ESM resolver captures the tolerant version at first
        ESM load
  - fix: replace got (unmaintained) with axios in download step
  - fix: update default remote to oxmc/nexe releases

  Features:
  - macOS binary signing support (patchMachOExecutable)
  - bundleRules option for fine-grained VFS include/exclude per module
  - Improved SnapshotZipFS path handling and fallback behaviour

test/options.spec.ts

@@ -43,7 +43,7 @@ describe('options', () => {
   describe('remote', () => {
     it('should use default remote', () => {
       const options = normalizeOptions({})
-      expect(options.remote).to.equal('https://github.com/nexe/nexe/releases/download/v3.3.3/')
+      expect(options.remote).to.equal(`https://github.com/oxmc/nexe/releases/download/v${require('../package.json').version}/`)
     })
     it('should append trailing slash to third-party remote if necessary', () => {
       const options = normalizeOptions({