release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

The first formal release.

- One-click install via Pinokio; keyless boot lands on a live Esri World
  Imagery satellite globe with keyless terrain, with automatic OSM fallback
  and graceful degradation when terrain is unavailable.
- Provider Settings (the POWER UP panel): add, replace, or remove API keys
  inside the app; credential files made owner-only before any secret is
  written; external keys shown read-only; the panel refuses shared or proxied
  servers.
- Keyless capability responses for the optional HUD summary and place search.
- Aircraft-identity voice answers cover operator, type, and route, and say so
  plainly when enrichment is unavailable.
- README rewritten keyless-first; concise 0.1.0 changelog section; CI
  workflow included.

Gates: 2,672 unit tests pass / 0 fail, build clean, tracking regression
108/108, map-source tray QA pass, setup doctor ready.

src/pinokioPreflight.test.mjs

@@ -0,0 +1,58 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { validatePinokioSharing } from '../scripts/pinokio-preflight.mjs';
+
+test('Pinokio stays local by default', () => {
+  assert.deepEqual(
+    validatePinokioSharing({ PINOKIO_SHARE_VAR: '__gev_sharing_disabled__' }),
+    { cloudflare: false, local: false, protected: false },
+  );
+});
+
+test('Pinokio refuses Cloudflare sharing on the current supported release', () => {
+  assert.throws(
+    () => validatePinokioSharing({ PINOKIO_SHARE_CLOUDFLARE: 'true' }),
+    /logs successful tunnel-login passcodes/,
+  );
+});
+
+test('Pinokio refuses its post-ready LAN sharing path too', () => {
+  assert.throws(
+    () => validatePinokioSharing({
+      PINOKIO_SHARE_LOCAL: 'true',
+      PINOKIO_SHARE_VAR: '__gev_sharing_disabled__',
+    }),
+    /PINOKIO_SHARE_LOCAL=false/,
+  );
+});
+
+test('Pinokio requires its share-trigger variable to remain isolated from the Open URL', () => {
+  assert.throws(
+    () => validatePinokioSharing({ PINOKIO_SHARE_VAR: 'url' }),
+    /PINOKIO_SHARE_VAR=__gev_sharing_disabled__/,
+  );
+});
+
+test('Pinokio matches the platform truthiness contract after trimming', () => {
+  assert.throws(
+    () => validatePinokioSharing({ PINOKIO_SHARE_CLOUDFLARE: ' true ' }),
+    /logs successful tunnel-login passcodes/,
+  );
+  assert.deepEqual(
+    validatePinokioSharing({
+      PINOKIO_SHARE_CLOUDFLARE: 'yes',
+      PINOKIO_SHARE_VAR: '__gev_sharing_disabled__',
+    }),
+    { cloudflare: false, local: false, protected: false },
+  );
+});
+
+test('a strong passcode cannot bypass the current sharing refusal', () => {
+  assert.throws(
+    () => validatePinokioSharing({
+      PINOKIO_SHARE_CLOUDFLARE: 'true',
+      PINOKIO_SHARE_PASSCODE: 'correct-horse-battery',
+    }),
+    /logs successful tunnel-login passcodes/,
+  );
+});