P1: Add release provenance and clean consumer compatibility matrix

[mrnicholasbcarter-code]

Context\nCore implementation and package boundary verification are merged (#23-#28). Remaining release evidence gap: clean-consumer verification currently proves one Node/ESM path, while publication provenance and compatibility coverage are not captured as a stable artifact.\n\n## Scope\nExtend package verification and publish documentation without publishing a release. Cover supported Node 20/22, ESM import, TypeScript declaration compilation, Express peer boundary, and explicit unsupported CJS behavior if CJS is not exported. Record npm package identity and provenance expectations without secrets.\n\n## Design\nKeep package contents allowlisted. Add a matrix-friendly verification command or CI job. Use local tarball only; do not depend on registry availability. If a requested axis cannot be tested, state why and mark it unsupported rather than guessing.\n\n## Acceptance criteria\n- [ ] Clean temporary consumer test covers Node 20 and Node 22 or documents runner limitation.\n- [ ] ESM root and exports verified.\n- [ ] TypeScript declarations compile with rationale documented.\n- [ ] Express peer dependency install/use is verified.\n- [ ] CJS behavior is explicit in README/package exports.\n- [ ] Publish workflow documents OIDC provenance and dry-run gate.\n- [ ] No credentials, registry mutation, or generated tracked artifacts.\n- [ ] Checking formatting...

All matched files use Prettier code style!, build, tests, and Verified 24 shipped files, clean ESM imports, and TypeScript declarations. pass.\n\n## Verification\n
added 407 packages, and audited 408 packages in 3s

77 packages are looking for funding
run npm fund for details

1 high severity vulnerability

To address all issues, run:
npm audit fix

Run npm audit for details.
Checking formatting...
All matched files use Prettier code style!
console.warn
[Forwarder] Model gpt-4 returned 429. Retrying in 0ms (attempt 1/3)...

  489 |                 : calculateRetryDelay(attempt, this.config.retryDelayMs);
  490 |
> 491 |               console.warn(
      |                       ^
  492 |                 `[Forwarder] Model ${model} returned ${response.status}. Retrying in ${delay}ms (attempt ${attempt + 1}/${this.config.maxRetries})...`
  493 |               );
  494 |

  at executeRequest (src/middleware/forwarder.ts:491:23)
  at src/middleware/forwarder.ts:566:9

console.warn
[Forwarder] Model gpt-4 returned 503. Retrying in 11.580016024735976ms (attempt 1/3)...

  489 |                 : calculateRetryDelay(attempt, this.config.retryDelayMs);
  490 |
> 491 |               console.warn(
      |                       ^
  492 |                 `[Forwarder] Model ${model} returned ${response.status}. Retrying in ${delay}ms (attempt ${attempt + 1}/${this.config.maxRetries})...`
  493 |               );
  494 |

  at executeRequest (src/middleware/forwarder.ts:491:23)
  at src/middleware/forwarder.ts:566:9

Verified 24 shipped files, clean ESM imports, and TypeScript declarations.
bodanglin-verdict-node-0.1.0.tgz\n\n## Implementation notes\nDo not change package identity or publish scope without an explicit release decision. Link evidence and CI run URLs from the PR.