feat(subscribers): pin, replace, and clear a subscriber location

[imjohnbo]

Closes #24, and fixes the pipeline gap that let it break main unnoticed.

The three endpoints

kit subscribers location pin <id> --city --state-province --country-code \
                                  --latitude --longitude --time-zone
kit subscribers location update <id>   # same six flags, all required
kit subscribers location delete <id>

Kit infers a subscriber's location from open events. Pinning overrides that.

PATCH is a full replacement rather than a merge, so update takes the same six
required flags as pin. A test asserts the two require an identical set, so they
cannot drift apart.

There is no get. Location comes back through include=location on list and
filter, which the CLI already supports.

Client additions

patch() joins get, post, put, and del. request() already handled the
verb.

Three validators, all with one job: turn a 422 into a clear CLI error.

Validator	Catches
validateFloatInRange	Coordinates out of range. Zero and negatives stay valid.
validateCountryCode	USA and United States. Upper-cases on the way out.
validateTimeZone	See below.

The time zone check needed more care than expected. Intl on its own accepts a
UTC offset like -07:00 and an abbreviation like PST, and neither is an IANA
name:

"America/Denver"   construct: true
"-07:00"           construct: true     <- not IANA
"PST"              construct: true     <- not IANA

An offset also ignores daylight saving, which is the reason to send a zone at
all. So the validator checks Intl.supportedValuesOf('timeZone'), allows UTC,
GMT, and the Etc/* family that the list omits, and returns the canonical
spelling. america/denver becomes America/Denver.

The pipeline gap

main was red at 496/497 and no CI run said so.

The spec-check workflow commits with [skip ci]. It pushed bd00f6f, a new spec
carrying these three endpoints, and scripts/spec-coverage.test.js began failing
by design. Because of [skip ci], the Tests workflow never ran on that commit.
The only reason this surfaced at all is that a later branch failed locally.

This PR removes [skip ci]. A spec change now fails Tests on main
immediately, which is what the coverage map is for. The comment in the workflow
records why, so nobody adds it back.

Review notes

Coverage: 76 operations, all mapped, no gaps.
Surface: 107 commands, snapshot regenerated.
Tests: 497 before, 560 after.

The semver gate reports the surface change as skipped, correctly. There is no
v0.0.1 tag yet, so there is no baseline to compare against. Once a release
exists, adding commands like these would require a minor bump.