1.6.0: re-exports, session ndebits (k1), CI compat suite

[shocknet-justin]

Summary

Release prep for @shocknet/clink-sdk 1.6.0: safer dependency usage for apps, session ndebit support per the CLINK Debits spec, request validators (ported from #17), and a real CI suite so nostr-tools upgrades don't land blind.

Consumer / API

• Re-export finalizeEvent, nip44, verifyEvent, and pool types from the SDK's pinned nostr-tools. Apps should import these from @shocknet/clink-sdk and not install a second nostr-tools (common cause of decrypt failures / missed responses).
• Sender lifecycle fixes: subscribe before publish, reject on decrypt/parse failure instead of hanging, ignore non-peer events (anti-DoS), keep the sub open for Noffer receipts (moreCb) then close after the receipt, ClinkSDK.Stop() to destroy the pool.
• Peer pubkey compare is case-insensitive (toPubKey normalized to lowercase hex).
• Verbose relay lifecycle logs are opt-in via setDebug(true) (default off).
• Session ndebits (k1) per CLINK Debits:
  • Optional TLV 3 on DebitPointer / ndebitEncode / decodeBech32
  • generateK1() / validateK1() (documented + exported; also ClinkSDK.validateK1)
  • newNdebitPaymentRequest(..., k1?, description?)
• Optional description on payment and budget builders (newNdebitPaymentRequest / newNdebitBudgetRequest, max 100 chars — same rule as noffer).
• Request validators (from closed add k1 to ndebit and export validators #17 / k1-and-validators): validateNofferData, validateNdebitData, validateBudgetFrequency, validateNmanageRequest + per-action nmanage helpers / validateOfferFields. Intended for inbound payload checks (e.g. server-side).
• NofferData.payer_data typed as Record<string, string> (was any).
• Docs: troubleshooting guide, README debit/session/validator examples, language-port vectors in test-vectors/interop.json (including TLV 3).

CI / quality

• Unit tests for bech32 (incl. session k1), request builders (incl. description), validators, and mocked sender lifecycle (incl. case-insensitive peer + debug logging).
• Offline compat: current SDK ↔ prior published SDK nip44 cross-decrypt, plus candidate nostr-tools override path.
• Relay ping-pong against local strfry (current client ↔ prior-SDK responder, dummy invoice + delayed synthetic receipt).
• Weekly poll workflow (Mondays UTC): if registry nostr-tools > pin, run the suite and open a bump PR only when green (else a tracking issue). Activates only after this merges to main (scheduled workflows run from the default branch). Pin today is 2.15.1; registry is already at 2.24.1.
• npm publish waits for a successful CI run on main (workflow_run).
• README CI badge.

Test plan

• npm test (unit) green locally
• npm run test:compat-offline green
• CI Actions run on this PR: unit + compat-offline + compat-relay
• Confirm session ndebit round-trip: encode with generateK1(), decode, payment request carries matching k1
• Confirm static (no-k1) ndebit strings still decode/encode unchanged
• Confirm request validators from add k1 to ndebit and export validators #17 are exported and covered by unit tests
• After merge: badge + publish gate both keyed off CI on main
• After merge: nostr-tools poll runs (or manual dispatch) and opens bump/tracking for 2.24.1