feat!: typed LM Studio discovery and 1.0 release foundation

[agustif]

Summary

Prepare opencode-lmstudio 1.0.0 as a correctness-first typed integration:

• replace model-name and family heuristics with runtime-validated LM Studio /api/v0/models metadata
• derive OpenCode config types from the current plugin hook contract
• skip embeddings safely, map VLM attachments, preserve user overrides/whitelists, and retain auth
• remove loaded-model request guards so LM Studio JIT loading works
• add current-OpenCode CLI smoke coverage, Microsoft TUI Test evidence, deterministic screenshots, and realistic sanitized LM Studio fixtures
• add CI, dependency review, safe manual release automation, release notes, changelog, migration guidance, and contributor credits
• prepare package version 1.0.0 without tagging, publishing, or creating a release

Intentional compatibility changes

• Dynamic discovery requires LM Studio's metadata-rich GET /api/v0/models endpoint.
• /v1/models is not used as a fallback because it cannot safely distinguish LLM, VLM, and embedding models.
• Display names and capabilities are no longer guessed from model IDs.
• Multiple named LM Studio providers remain follow-up work tracked by feat: support multiple LM Studio provider instances #10.

Validation

• actionlint
• shellcheck test/opencode-fixture.sh
• npm run validate
• npm run test:coverage — 91.3% statements, 80% branches, 100% functions, 90.9% lines
• npm audit --audit-level=high — 0 vulnerabilities
• latest pinned OpenCode real CLI smoke — passed
• pinned OpenCode Microsoft TUI Test and deterministic screenshot comparison — passed
• npm run release:check — passed; performs no release actions
• clean opencode-lmstudio-1.0.0.tgz install/import — passed; no stale deleted modules

Community credit

This rewrite incorporates or was directly informed by work from @trigger2k20 (#29), @aluzed (#30), @rashomon-gh (#27), @scott1028 (#26), @z3r0-815 (#25), @bluelovers (#23), @SerenityG4K (#22), @Lzmatgh (#18/#19), @HarelMil (#13), and @jleaders (#10). See CONTRIBUTORS.md and docs/releases/v1.0.0.md.

Release safety

This PR does not publish npm, create a tag, or create a GitHub release. The new release workflow is manual, defaults to validation-only, and requires an exact committed version plus a curated release-notes file.