[lukewilliamboswell]

The November 13 Roc nightly reports six duplicate-definition warnings in basic-cli 0.28.0. Move the opaque command implementation beside the Cmd namespace and keep Cmd.Command as its public alias; rename the two shadowing Path.parent closure parameters. Existing command signatures, method lookup, docs, and opacity are preserved.

Upgrade CI, release builds, docs, and the Nix development shell to the latest published nightly, nightly-2026-11-13-03dce41. It contains roc-lang/roc#12996, which fixes the Windows compile-time literal failures in #555. Add an uncached platform check to source validation so both warnings and literal evaluation failures fail CI. Use the official nightly for static runtime validation, retaining native execution, PIE/ASLR, and development-backend callback coverage. Nix temporarily supplements the upstream overlay with official archive hashes because its metadata currently stops at November 12.

Prepare version 0.28.1 and release notes, including the entry-point argument annotation from #554. Native linker inputs remain pinned to the existing verified artifacts.

Validation (all CI green at 5032f62):

• All 758 platform tests and native scenarios passed on all five supported targets.
• Release bundle tests passed on Ubuntu 22.04, macOS 15 (Intel and Apple Silicon), and Windows 2025; docs archive passed.
• Full Linux scripts/test.py: source checks, all 758 platform tests, host tests, example builds, and native run cases passed.
• roc bump against 0.28.0: no public API changes; 0.28.1 satisfies the patch bump.
• Generated docs retain Cmd.Command and its methods.
• Release tooling: 62 tests passed (3 platform/toolchain skips).
• OS witness API: 1 positive and 22 negative checks passed.
• External field access remains rejected as Cmd.Command is opaque.
• All 53 Linux example executables are static PIE; randomized loading passed.
• Native resource ownership passed with glibc and Valgrind; musl allocator syscall checks passed.
• Nix flake evaluation passed on all four supported systems; CI also builds and verifies the development compiler.

Closes #556.
Closes #555.