Add CI, release workflow with provenance, and changelog

[krkarma777]

Summary

• CI workflow: typecheck + full test suite + build on Node 24, then a compatibility matrix (Node 16/18/20/22) that runs ESM and CJS smoke tests against the built dist — the first actual verification of the `engines: >=16` claim
• Release workflow: publishes on version-tag push via npm trusted publishing (OIDC) with provenance attestation; token fallback documented inline
• CHANGELOG.md (Keep a Changelog format) backfilled for 1.0.0/1.0.1
• CI status badge in the README badge row

Note: the release workflow needs a one-time Trusted Publisher configuration on npmjs.com (package Settings → Trusted publisher → this repo + release.yml) before tag-push publishing works.

Test Plan

• scripts/smoke.mjs / smoke.cjs pass locally against a fresh build
• CI runs on this PR (both jobs) — see checks below