v1.2.1: Continuous integration, and the last two undocumented settings

Added

• Every push and pull request is now checked by CI (.github/workflows/lint.yml). The
  repository had no CI at all until now, so every check ran locally or not at all. The
  workflow runs typecheck (bun install --frozen-lockfile + bun run typecheck), ShellCheck
  on the two shell scripts, an XML parse of the LaunchAgent template, three
  configuration-documentation gates, a relative-link check across all Markdown, a changelog
  link-definition check, and gitleaks over the full history
• CLAUDE_CODE_PATH is documented in .env.example and README.md. It sets the Claude
  Code executable handed to the Agent SDK (src/session.ts) and is needed for standalone
  builds
• DOCS_DIR is documented in .env.example and README.md. Claude scans this directory
  for existing documentation before diagnosing an alert (src/config.ts); default
  ~/Documents/docs

Fixed

• CLAUDE_CODE_PATH and DOCS_DIR were findable only by reading the source. Both were
  configurable in code and appeared in no documentation
• Four documented settings were missing from the README configuration table.
  CLAUDE_CLI_PATH, WHISPER_CLI_PATH, AUDIT_LOG_MAX_SIZE and AUDIT_LOG_MAX_FILES were
  documented in .env.example but not in the table
• The [Unreleased] compare link pointed one release too far back. The [1.2.0] compare
  link was never added in the 1.2.0 release, which left [Unreleased] comparing against
  v1.1.0. Both corrected, and the check is now part of CI

Changed

• .gitignore now covers local agent tooling and further private note formats.
  .claude/, REDDIT_POST.md, TODO.md, NOTES.md. CLAUDE.md stays versioned on
  purpose: it is the shipped example system prompt, documented in README.md and
  CONTRIBUTING.md