fix: close TypeScript 7 integration gap and document release

[dbarrante]

Summary

• fix the post-merge TypeScript 7 integration failure introduced when PR Fix: terminal auth 401 on model-select + UX/UI cleanup #47 landed after PR feat: migrate terminal to TypeScript 7 #49
• preserve the exact bearer token used by each request/retry while routing headers through the existing private auth seam
• add a live CI badge to the public README
• document the verified TypeScript 7.0.2 and Node 24 development baseline
• publish the exact release-gate commands and package-surface contract
• link the migration design and the forthcoming v0.1.0 verified baseline tag

Root cause

PR #47 replaced the normal request paths' calls to authHeaders() with direct calls to bearerFor(). The private authHeaders() seam remained necessary for media downloads, but TypeScript could not see that cast-based external use and rejected it under PR #49's noUnusedLocals setting. Each PR passed independently against its earlier base; the combined main state had not been revalidated.

Validation

• TypeScript 7.0.2 strict typecheck passed
• 687 tests passed locally
• 687 tests passed under Node 24
• CLI help and runtime smoke checks passed
• npm audit reports 0 vulnerabilities
• npm package dry run includes dist/src and excludes dist/test
• PowerShell and POSIX installer syntax checks passed
• source audit found no TypeScript suppressions, CommonJS require calls, or non-TypeScript application/test code