Add guided CLI reports and recover release verification

[cucuwang]

Problem and change

Add a guided terminal flow that scans a URL, file or directory and saves an HTML report. Recover post-publication npm verification with bounded visibility polling against the exact release source; also update supported dependencies, Action pins, skill safety guidance and installation docs.

Includes the changes covered by #21, #23, #25, #26, #27 and #28. Keeps Node 24 types; #24 remains deferred.

Validation and impact

• Tests/build pass. Local npm run release:check passed on Node 22.12.0 and 24.11.1, with 275 tests per runtime and byte-identical tarballs. GitHub CI will validate this PR.
• CLI, API, JSON and Action contracts preserved or changes documented. Eight PTY scenarios passed per runtime, including cancellation and existing-file protection; the new menu is documented.
• Security and dependency impact reviewed. npm audit found zero vulnerabilities; browser smoke checks passed on both runtimes, and third-party Actions use verified full SHAs.
• Scoring/methodology impact stated. Scoring rules and evidence contracts are unchanged.
• Documentation and changelog updated, including Unreleased notes and two local review reports.
• Release/package impact stated. The recovery wrapper passed public v0.10.0 verification. Package metadata remains 0.10.0; a new version and release preparation are required before publishing these changes.

For reviewers, check that cancellation cannot leave an output file and release verification retries visibility delays only.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.