feat(reliability): add coding-safe compression profiles

[diegosouzapw]

Summary

• Add named coding-safe, balanced, aggressive, and passthrough compression profiles.
• Keep authority, tool schemas, reminders, and live tool results native under safe profiles.
• Apply non-weakenable profile boundaries in the public API, Node host, and Cloudflare Worker.
• Preserve the existing aggressive behavior as the default and only narrow model admission in safe scopes.
• Document OMNIGLYPH_PROFILE in the operational flags section.

Related Issues

• N/A in this repository.

Validation

• pnpm run lint is clean
• pnpm run typecheck is clean
• pnpm test passes (74 files, 1125 tests)
• pnpm run build succeeds (bundle + --version smoke)

Tests

• Added tests/safety-profile.test.ts.
• Extended tests/public-api.test.ts.
• Covered profile resolution, non-weakenable overrides, model-scope narrowing, Node and Worker composition, passthrough behavior, and native authority/live-state preservation.
• New behavior followed TDD: policy, host wiring, model gate, and public API assertions failed before their implementations.

Measurement

• No billing formula or profitability threshold changed.
• Safe profiles only narrow the measured default model allowlist; they cannot promote configured experimental models.
• No fail-closed gate or test was weakened.
• Harness: N/A; no new model-quality or savings number is introduced.

Docs / i18n

• npx vitest run tests/docs-integrity.test.ts tests/safety-profile.test.ts tests/public-api.test.ts passes (27 tests).
• The README and changelog document the new environment profile.
• No translated catalog key changed.

Reviewer Notes

• This adapts the policy to the existing OmniGlyph transform boundaries. Safe profiles disable each authority/live-state imaging lane explicitly instead of changing the global minimum-character threshold.
• Invalid environment profiles fail closed at the production model gate.

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud

[diegosouzapw]

Superseded by #48, which is the canonical combined port with provider-specific history floors and both Node and Worker integration. Keeping this branch intact for audit history.