Cross-platform image commands, scoped env files
Four post-merge hardening fixes landed: Windows path separators now work in the image command, environment file lookups are scoped to the gitpulse repo root, and subcommand modules load after .env.local is available.
The image command and environment loading in the gitpulse CLI just got more robust. Windows users can now pass local file paths to the image subcommand — the previous regex assumed forward slashes only, so any Windows-style path like C:\Users\...\story.json would silently fail to extract a story ID. The fix uses path.basename and a simple string check instead, handling both separator styles.
Environment file security also improved. The CLI previously walked up the directory tree from wherever it was invoked looking for .env.local, which meant running the analyzer from a parent directory containing its own .env.local would accidentally pull in those secrets. Now the search is scoped to the gitpulse repo root (identified by .gitpulse.json), so outside processes can never pollute the analyzer's environment.
Two additional changes prepare the codebase for future growth. Subcommand modules now load lazily via dynamic import() after the environment is loaded, ensuring any future top-level process.env reads in those files work correctly. And a deriveStoryId helper was extracted so the pr-<n> vs commit-<shortSha> id format is defined once and shared between the commit processor and the story renderer.
All 79 unit tests pass.