Harden the local bridge and document repo handoff

[anushkmittal]

Summary

• Document the repo-URL handoff: after connecting, a Shape clones locally, reads SHAPE.md/AGENTS.md/llms.txt/README, and follows the repo's contract; private credentials stay local
• Add a zero-dependency Node test suite for auth, run, write/read, and bounded large-file reads
• Compare bearer tokens in constant time
• Bound command buffers (4 MiB), file reads (100 KiB without loading the whole file), and directory listings (2,000 entries)
• Return explicit truncation metadata
• Add CI on minimum supported Node 18 and current Node 22, including package dry-run

Test plan

• npm test — 4 protocol tests pass (~100ms)
• npm pack --dry-run — expected 7-file, zero-dependency package

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.