[codex] harden shotkit CLI and package boundary

[heznpc]

Summary

• make CLI usage errors explicit for missing option values, unknown flags, and extra positional args
• return JSON-mode usage failures on stderr with exit code 2
• add package-boundary tests that keep research harnesses, generated runs, examples, and application planning docs out of the npm release slice

Validation

• npm ci
• npx jest test/cli.test.js test/package-boundary.test.js --verbose
• npm run lint
• npm test
• npm audit --audit-level=high
• npm pack --dry-run --json
• node bin/shotkit.js --wat --json
• npm run research -- --topic "shotkit handoff package boundary smoke" --date 2026-06-22 --dry-run
• npm run research -- --dry-run
• npm run research -- --topic "date validation smoke" --date 2026-99-99 --dry-run