fix: enforce options boundary and patch release flow

[tensornull]

What changed

• exclude provider, workloadIdentity, and dangerouslyAllowBrowser from CometAPIOptions and inherited withOptions
• reject runtime/type-bypass use with secret-free official OpenAIError instances
• add executed source and packed ESM/CJS negative type tests while preserving supported OpenAI options and error identity
• repair stable Release Please patch discovery, reviewed PR configuration, immutable Release creation, and the exact-run handoff to npm OIDC publication
• add fail-closed stale-branch, rerun, approval, action-result, tag, Release, and workflow identity validation
• document the 0.1.1 maintenance boundary and the failed 0.2.0 branch root cause

Root cause

The public options type omitted only apiKey and baseURL, so it accidentally admitted upstream routing, workload identity, and browser bypass fields that conflict with the CometAPI-owned route/auth/security boundary. Separately, the post-0.1.0 Release Please run had no discoverable published tag/Release boundary, rediscovered the initial feature commit, and generated 0.2.0; PR creation then failed independently because Actions PR authorization is disabled.

Validation

• npm ci
• npm run format:check
• npm run lint
• npm run typecheck
• npm test (13 files, 276 tests)
• npm run verify:offline
• npm run check:self-contained from committed HEAD
• npm run actionlint (1.7.12)
• git diff --check
• Release Please 17.6.0 dry-run: exactly one 0.1.1 PR updating package, lock, manifest, and changelog; no 0.2.0

No 0.2 provider adapters are included.