fix: harden options and publication contracts

[tensornull]

Summary

• make the three CometAPI-owned constructor controls structurally unsupplyable through variables, spreads, generics, and withOptions while retaining secret-free OpenAIError runtime guards
• remove mutable exact-version state from durable documentation and make package.json the sole candidate-version authority
• enforce publication-neutral source and packed READMEs so normal four-file Release Please patch PRs remain sufficient

Verification

• npm ci
• npm run verify (520 tests plus exact copied standalone repository verification)
• node scripts/validate-release.mjs --require-final --require-releasable-docs
• npm audit --omit=dev --audit-level=high
• git diff --check

No 0.2 resource surface is included.