Adds a bounded zero-dependency local CLI alongside the GitHub Action. New limits cover input and lookup file counts, aggregate CSV bytes, lookup rows, output columns, and total generated output. The npm package manifest and five-file tarball are verified locally, but the package is not yet published to npm. The existing v1 tag remains on v1.0.0 until the npm first-publish handoff is complete.