release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

The first formal release.

- One-click install via Pinokio; keyless boot lands on a live Esri World
  Imagery satellite globe with keyless terrain, with automatic OSM fallback
  and graceful degradation when terrain is unavailable.
- Provider Settings (the POWER UP panel): add, replace, or remove API keys
  inside the app; credential files made owner-only before any secret is
  written; external keys shown read-only; the panel refuses shared or proxied
  servers.
- Keyless capability responses for the optional HUD summary and place search.
- Aircraft-identity voice answers cover operator, type, and route, and say so
  plainly when enrichment is unavailable.
- README rewritten keyless-first; concise 0.1.0 changelog section; CI
  workflow included.

Gates: 2,672 unit tests pass / 0 fail, build clean, tracking regression
108/108, map-source tray QA pass, setup doctor ready.

scripts/pinokio-preflight.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export function isPinokioShareEnabled(value) {
+  return /^(1|true)$/i.test(String(value || '').trim());
+}
+
+export function validatePinokioSharing(env = process.env) {
+  const cloudflare = isPinokioShareEnabled(env.PINOKIO_SHARE_CLOUDFLARE);
+  const local = isPinokioShareEnabled(env.PINOKIO_SHARE_LOCAL);
+  const shareVariable = String(env.PINOKIO_SHARE_VAR || '').trim();
+  if (cloudflare || local || shareVariable !== '__gev_sharing_disabled__') {
+    throw new Error(
+      'Pinokio sharing is unavailable because the current supported release can expose the app after child preflight '
+      + 'and logs successful tunnel-login passcodes. Keep PINOKIO_SHARE_CLOUDFLARE=false, '
+      + 'PINOKIO_SHARE_LOCAL=false, and PINOKIO_SHARE_VAR=__gev_sharing_disabled__.',
+    );
+  }
+  return { cloudflare: false, local: false, protected: false };
+}
+
+function run() {
+  validatePinokioSharing();
+  console.log('[Pinokio] Local-only launch.');
+}
+
+const invokedPath = process.argv[1] ? path.resolve(process.argv[1]) : '';
+if (invokedPath === fileURLToPath(import.meta.url)) {
+  try {
+    run();
+  } catch (error) {
+    console.error(`[Pinokio] ${error.message}`);
+    process.exitCode = 1;
+  }
+}