release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

The first formal release.

- One-click install via Pinokio; keyless boot lands on a live Esri World
  Imagery satellite globe with keyless terrain, with automatic OSM fallback
  and graceful degradation when terrain is unavailable.
- Provider Settings (the POWER UP panel): add, replace, or remove API keys
  inside the app; credential files made owner-only before any secret is
  written; external keys shown read-only; the panel refuses shared or proxied
  servers.
- Keyless capability responses for the optional HUD summary and place search.
- Aircraft-identity voice answers cover operator, type, and route, and say so
  plainly when enrichment is unavailable.
- README rewritten keyless-first; concise 0.1.0 changelog section; CI
  workflow included.

Gates: 2,672 unit tests pass / 0 fail, build clean, tracking regression
108/108, map-source tray QA pass, setup doctor ready.

scripts/qa-attribution-b12.mjs

@@ -1,7 +1,7 @@
 /**
  * qa-attribution-b12.mjs — visual + state proof for Batch 12 (data attribution).
  *
- * Public attribution checks:
+ * Findings H10 + H11 (docs/pre-ship-audit-2026-07-01.md):
  *   H10 — the Google/Cesium credit MUST stay visible in clean-view AND
  *         recording modes (those are the modes used to record demos).
  *   H11 — every data layer's required attribution must surface in the
@@ -89,6 +89,14 @@ async function main() {
       });
       return;
     }
+    if (url.origin === APP_ORIGIN && url.pathname === '/api/google/nearby-places') {
+      request.respond({
+        status: 200,
+        contentType: 'application/json',
+        body: JSON.stringify({ places: [] }),
+      });
+      return;
+    }
     request.continue();
   });