Backfill CHANGELOG [1.2.0] and add copilot-instructions for agent hygiene

[Copilot]

[1.2.0] was released as a large squash commit but its CHANGELOG entry was left blank. Several post-release changes that shipped under 1.2.0 were also undocumented. Additionally, agent sessions were repeatedly omitting version bumps, changelog entries, and related housekeeping steps.

CHANGELOG [1.2.0] backfill

Documented everything that shipped while the package was at 1.2.0 but was never recorded:

• TypeScript definitions (index.d.ts) — the most significant omission; provides typed options, all methods, and all events
• Default saveDelay 0ms → 100ms — breaking change called out in the release commit message but absent from the changelog
• llms.txt — machine-readable API reference for AI tooling
• Improved JSDoc on save() callback and handler parameter; fixed misleading internal comment
• GitHub Actions CI — Node 18/20/22 matrix, Codecov upload, live badges
• CONTRIBUTING.md and SECURITY.md
• CI reliability fixes — increased test timing margins to eliminate flaky failures on loaded runners

Version bump: 1.2.0 → 1.3.0

createIfMissing option and named exports (module.exports.Filejson / .default) added in PR #16 were additive and backward-compatible but never got a version bump or changelog entry. Bumped to 1.3.0 and documented both additions under [1.3.0] - 2026-04-30.

.github/copilot-instructions.md (new)

Added standing instructions automatically picked up by Copilot agent sessions to prevent recurrence:

• Semver decision table (major / minor / patch / none) with clear criteria
• Mandatory steps: update package.json version and add a matching CHANGELOG.md entry per PR
• Hard rules: no orphaned version numbers; no undocumented public API changes
• Reminders to keep index.d.ts in sync with app.js and update README.md for new user-facing features