chore: restore active maintenance for v1.4.0

[coderwhy]

Summary

• establish community maintenance, contribution, and private security-reporting guidance
• fix event-bus listener cleanup, one-time listener iteration, and prototype-key event names
• return synchronous and Promise action results from dispatch
• validate store configuration, state keys, and atomic multi-state listener operations
• add comprehensive regression tests and automated package validation
• remove the unused vulnerable demo dependency and tighten npm package metadata
• refresh English and Chinese API documentation for the maintained behavior

Why

The repository had several long-standing edge cases reported by users, no automated CI gate, and stale package/documentation metadata. This maintenance cycle restores a small, reviewable release path for v1.4.0 while preserving the existing API shape.

User impact

• event names such as constructor, toString, and __proto__ now work safely
• once, off, clear, and hasEvent behave consistently
• callers can await or directly consume values returned by dispatched actions
• invalid configuration and unknown state keys fail clearly instead of creating partial or unobservable state
• published package contents are constrained to the runtime source and documentation

Validation

• 14/14 regression tests pass
• core source files have 100% line, branch, and function coverage
• GitHub Actions passes on Node.js 18, 20, 22, 24, and 26
• npm audit --audit-level=low: 0 vulnerabilities
• npm pack --dry-run: passes
• clean-package installation and consumer smoke test: passes
• node --check and git diff --check: pass

Related: #24, #25, #26, #27, #29, #30, #31, #32, #33

Credits: the dispatch return-value behavior follows the contribution proposed by @Thunder7991 in #32.