fix: harden options and Release Please patch flow

[tensornull]

Summary

• enforce the CometAPI-owned route/auth/browser options boundary in the constructor and inherited withOptions
• snapshot supported option accessors once, preserve supported OpenAI options, and add real tsc negative tests
• constrain Release Please to reviewed stable 0.1.x patches and bind same-run recovery to the exact run, attempt, candidate, review, immutable Release, and CHANGELOG notes
• keep publication fail-closed on the exact attempt artifact, immutable release, packed artifact, live smoke, npm OIDC, provenance, integrity, and public installation

Root cause

The manual v0.1.0 draft was not a discoverable Release Please boundary when post-merge run 30345116433 started. Release Please 17.6.0 therefore scanned older Conventional Commits, including the initial feature, and generated an unwanted 0.2.0 temporary-branch commit. PR creation then failed independently because Actions PR authorization was disabled at that time.

The pinned implementation creates a GitHub Release before its later comment/label transitions and emits action outputs only after the whole release call returns. Recovery therefore uses exact attempt/job/step evidence and the Release publication time; GitHub created_at reflects the target commit timestamp and is not creation provenance.

Impact

A normal fix: commit after the exact 0.1.0 boundary can prepare only 0.1.1. Manual preparation is release-inert. A merged release PR must retain exact final-head human-admin approval and reviewed notes; only its exact push run may create or recover the immutable Release and enter publication.

Verification

• npm ci
• npm run verify:offline (13 files, 358 tests)
• focused release/workflow suite (148 tests)
• npm run check:self-contained on committed HEAD
• package tarball, publint, Are the Types Wrong
• README ESM/CommonJS examples
• ESM, CommonJS, compatible-OpenAI host, single OpenAI installation, APIError identity
• locked OpenAI 6.47.0 on local Node 26 advisory runtime
• npm run actionlint (1.7.12)
• git diff --check

Remote Node 22/24 blocking lanes, minimum OpenAI, and the manually dispatched latest OpenAI 6.x lane must pass on exact head 4ffee490b238b759d39195f6ef36853456871f4f before merge.