Prepare for open source: docs, license, and robustness fixes

[pwerry]

Gets the repo ready to open-source and hardens the agent wrappers/orchestrator based on a review pass.

Docs & meta

• README.md — overview, the two-arm (baseline vs context-enhanced) pipeline, requirements, install, fixture + CLI usage, options table, output, contamination control
• LICENSE — MIT © Unblocked (matches the declared license field)
• CONTRIBUTING.md — dev setup, how to add a new agent, PR checks
• .github/workflows/ci.yml — typecheck + lint on push/PR
• package.json — repository / homepage / bugs / keywords metadata

Fixes from review

Area	Change	Why
Security	Capture diffs via execFileSync (no shell), null-delimited filenames	Untracked filenames were interpolated into a shell string
Resource leak	Await both arms with allSettled	A contamination/error in one arm orphaned the other's live process while cleanup tore down its worktree
Robustness	stdin EPIPE guards (claude, codex)	Unhandled throw if the child exits before reading stdin
Robustness	SIGTERM → SIGKILL escalation (claude, codex, cursor)	Hung agents that ignore SIGTERM never terminated
Correctness	codex timeout no longer reported as success	Polluted the pass/fail signal (partial result still retained)
Correctness	claude timeouts reported distinctly	Previously masked as a generic "no result" failure
Correctness	cursor trailing-line flush on close	Result event without a trailing newline was lost
Robustness	grok never fails a run over best-effort token reads	Unreadable session dir threw
Observability	Warn once on unknown-model pricing fallback	Silent wrong-cost

npm run typecheck and npm run lint both pass.

Notes

• Kept the Unblocked branding in the HTML report (intentional — this is Unblocked's tool).
• Kept package.json private: true — it's a clone-and-run tool (no bin), so this prevents an accidental npm publish.