Initial implementation: Patchwave analysis CLI - #1

The injectable-dependency foundation everything else builds on,
following the Context + XxxImpl/FakeXxx convention.

- types.ts: shared domain types for collected data and the report
- context.ts: Context interface + createContext() wiring
- environment.ts, errors.ts, time.ts, concurrency.ts, logger.ts:
  cross-cutting primitives (env parsing, error helpers, Temporal
  wrappers, bounded concurrency, structured logging)
- Clock, FileSystem, BaseIo/IoImpl: I/O dependency interfaces +
  production implementations
- github/: GithubClient (REST/GraphQL), token resolution (auth.ts),
  and discriminated-union error mapping (errors.ts)
- Analytics + anonymousId: opt-out PostHog telemetry with a stable
  anonymous id

Deterministic test doubles implementing the Context dependency
interfaces, swapped in without module mocking:

- testHelpers/Fake{Analytics,Clock,FileSystem,GithubClient,Io}.ts:
  inspectable fakes for each injectable dependency
- testHelpers/MemoryStream.ts: in-memory writable for IO assertions
- testHelpers/createFakeContext.ts: assembles a fully-faked Context
- testFactories.ts: builders for domain fixtures used across tests

Per-domain GitHub collectors plus the classification heuristics they
feed. Each collector accepts its client/IO via Context and returns a
Result; per-repo failures are surfaced as warnings rather than
aborting the run.

Collectors:
- repos: org repo listing + language breakdown
- contributors: active committers
- branchProtection: required-checks / protection rules
- dependabotConfig: presence and shape of dependabot config
- dependabotPrs: Dependabot PR history
- cve: security/CVE alerts
- reverts: revert detection, indexed against Dependabot PRs

Heuristics:
- bumpType: semver bump classification + dev-dependency detection

Turns collected data into the shippable report artifact.

- aggregate.ts: folds collector output into the ReportBundle —
  per-repo and org-wide rollups, time series, risk/automation slices
- costFormulas.ts: labor/cost model used by the savings estimates
- bundle.ts: assembles report files and zips them (fflate)
- html.ts: renders the single-file HTML report, inlining the built
  web bundle (dist/report-web) as a text import
- testFactories.ts: report-layer fixture builders

The interactive single-page report embedded into the HTML artifact.

- web/App.tsx + acts/ (Verdict, CostStory, RiskStory, AutomatedStory,
  CallToAction, MethodologyAppendix): the narrative report sections
- web/primitives/ (charts, citation, brand mark, rows): presentational
  building blocks
- web/data/: reads the embedded ReportBundle + citations via context
- web/hooks/useAssumptions: user-tweakable cost assumptions
- web/format/: bytes/days/money formatters
- web/index*.{html,tsx}: production + dev (HMR) entrypoints, styles,
  and fixtures
- scripts/build-report-web.ts: bundles the web app into dist/report-web

Wires the collectors and report pipeline behind a CLI and documents
the project.

- src/index.ts: bin entrypoint — resolves token, builds Context,
  sets up telemetry, delegates to main()
- src/cli.ts: arg parsing, the collect -> aggregate -> render/bundle
  orchestration, and human-facing error formatting (the only place
  Results are unwrapped)
- removes the placeholder root index.ts
- README.md: usage and overview; CLAUDE.md: project conventions