Support API 0.3 reviewed GapSets

[raghubetina]

Summary

• require the Service API 0.3 contract
• validate and print the complete reviewed GapSet and digest from plan status
• require the reviewed Analysis Head SHA to match the exact accepted local source before Compile, even when a
  byte-different Head kept the same graph version
• keep generic responses at 2 MiB while allowing 128 MiB Analysis and artifact responses
• raise the unpublished CLI package to 0.2.0

This is the coordinated CLI side of firstdraft/firstdraft#430. It does not publish the package or change any
registry tag.

Verification

• npm run check: 158 tests plus type, lint, format, package, and smoke checks
• npm audit: 0 vulnerabilities
• accepted the Service Oscar Party 71-gap golden and pinned zero-gap contract
• same-generation, byte-different Head regression proves Compile creates no Publication
• independent contract audit completed; canonical ordering and exact-Head findings fixed
• hosted Node 22 Ubuntu/macOS/Windows and Node 24 quality jobs green