* feat(cli): scaffold create-junando-app bootstrap command (Tier 1)

Adds packages/create-junando-app, a zero-runtime-dependency CLI that
scaffolds the Express end-to-end example as a starter project.

Usage:
  pnpm create junando-app my-app
  npx create-junando-app my-app

Tier 1 scope (final):
- Copies examples/express-end-to-end/ into the target dir
- Rewrites app/package.json name to the project basename
- Runs pnpm install in the new project
- Prints next-steps message
- No prompts, no env validation, no docker stack (Tier 2/3 deferred)

Packaging boundary hardened after fresh-context review found two
critical publish bugs:
- npm strips .gitignore from tarballs by default; template ships
  _gitignore and scaffold renames it back, so users do not commit
  secrets on first git push
- prepublishOnly script runs clean + build + verify-tarball.js, which
  asserts the tarball contains required files (shebang, template,
  .env.example) and rejects forbidden paths (node_modules, lockfile)

Also addressed:
- Path traversal: project paths containing .. segments are rejected
- Version read from package.json instead of hardcoded duplicate
- readdir error narrowed to ENOENT to surface real failures
- 346 tests passing (15 new), including .gitignore rename coverage

Note: this PR is ~700 lines because it adds a complete new package.
Cannot be sliced without breaking coherence. Maintainer-approved
size:exception.

Closes #76

* chore(release): bump to 0.7.0 and add create-junando-app to publish pipeline

Minor bump (0.6.4 -> 0.7.0) — first release shipping create-junando-app
as the canonical onboarding entrypoint.

Sync-version across all 5 publishable packages and the root for now;
independent per-package versioning is tracked separately as #84
(changesets adoption).

Pipeline changes:
- scripts/verify-package-files.mjs: add create-junando-app to the
  verification set; handles unscoped name correctly in display
- .github/workflows/npm-publish.yml: add publish step for
  create-junando-app with the same provenance + dist-tag pattern as
  the other packages

Auto-tag workflow will create v0.7.0 on merge and trigger npm-publish
automatically — no manual tag push required.

* fix(create-junando-app): move .gitignore to app/ and add .nvmrc

Smoke test of PR #105 revealed two CRITICAL onboarding issues:

1. .gitignore was placed at scaffold root (/tmp/my-app/.gitignore) but
   package.json lives in /tmp/my-app/app/. Users run `git init` inside
   app/, so the .gitignore was useless and .env would get committed.
   Moved the gitignore (and the _gitignore publish workaround) into app/.

2. No .nvmrc meant nvm did not auto-switch on `cd my-app/app`, leaving
   users on Node 20 (or whatever default) and failing with cryptic
   node:sqlite ERR_UNKNOWN_BUILTIN_MODULE. Added .nvmrc=24 in app/.

Also clean up two pre-existing unused imports flagged by oxlint
--deny-warnings (CI was failing on this).

Tests updated to match new app/_gitignore -> app/.gitignore rename path.
Verified end-to-end: scaffold to /tmp/my-app produces correct
app/.gitignore, app/.nvmrc, package.json.name, and pnpm install runs.

Refs #76

* fix(create-junando-app): auto-create app/.env from .env.example

Scaffold smoke test revealed two related onboarding issues:

1. .env.example was at template root but pnpm dev runs from app/ with
   `node --env-file=.env`. The Next steps message said
   `cp .env.example .env` from inside app/ — which would fail because
   .env.example wasn't there. Moved .env.example into app/ so it lives
   next to the package.json that consumes it.

2. `node --env-file=.env` is strict: it fails immediately if .env is
   missing, even when the server reads no vars from it. Users hit
   `node: .env: not found` instead of seeing the demo run.

Fix: scaffold now copies app/.env.example -> app/.env automatically
(without overwriting if .env somehow exists). Next steps message
collapses from 3 commands to 2:

  cd my-app/app
  pnpm dev

The .env carries placeholder LLM/Slack values; the message tells users
to edit them when they wire the full pipeline. This matches the
Next.js/Vite convention of leaving a ready-to-run dev env.

Tests: 4 new (env copy on present, no overwrite, no-op when missing,
next-steps no longer instructs cp). 25/25 passing. Lint clean.
Verified end-to-end: server arranca y /health responde 200 OK.

Refs #76

* chore(docs): regenerate compatibility matrix for 0.7.0 bump

CI `Verify compatibility matrix` failed because docs/compatibility.md
still showed 0.6.4 for the four core publishables. The matrix is
auto-generated by scripts/generate-compat-matrix.ts and CI runs --check
to enforce it stays in sync with package.json versions.

Regenerated; diff is purely the lockstep bump 0.6.4 -> 0.7.0 for
@junando/core, @junando/ingest, @junando/webhook, @junando/worker.
@junando/cdk stays at 0.1.0 (not published). create-junando-app is not
in this matrix because it is not a runtime peer.

Refs #76

* docs(readme): sync Quick start with auto-created .env

The scaffold now copies .env.example -> .env automatically (commit
de28cdc8), so the Quick start no longer needs the manual cp step.
README was lagging behind the CLI message.

Refs #76