Merge upstream/main into pr/mapillary-layer

Brings in #744 (share-link token ledger). package.json: keep the branch's
sorted scripts and add layer-token:next and layer-token:check.

Street Level's token moves from the provisional `3` to `0`: following
CONTRIBUTING, the provisional entry was removed and
`npm run layer-token:next -- street-level` assigned `0` (free digits in
order). It is added to the registry and to
src/data/layerStateTokenReservations.json, and
`npm run layer-token:check -- --base-ref upstream/main` passes (28
published, 1 new). No link with the provisional token was ever published.

Pinned token tests move with the ledger as CONTRIBUTING asks: 29
reservations, next free digit `3`, and the competing-PR and retired-digit
scenarios shift up one free digit (0->3, 3->4) so they still test the same
rules. The README share examples and the free-digit notes in
CONTRIBUTING and CURRENT-STATE now read `0`.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/data/layerStateTokenReservations.json

@@ -0,0 +1,31 @@
+[
+  ["ais-live-vessels", "a"],
+  ["alpr-cameras", "p"],
+  ["bhote-koshi-2026", "h"],
+  ["bhote-koshi-locator", "z"],
+  ["bikeshare", "b"],
+  ["cctv", "c"],
+  ["directions", "n"],
+  ["earthquakes", "e"],
+  ["fire-perimeters", "2"],
+  ["flights", "f"],
+  ["local-dams", "q"],
+  ["local-datacenters", "d"],
+  ["local-firms", "w"],
+  ["military", "m"],
+  ["military-awareness", "g"],
+  ["military-installations", "i"],
+  ["radio", "r"],
+  ["recent-imagery", "1"],
+  ["rocket-launches", "x"],
+  ["satellites", "s"],
+  ["street-level", "0"],
+  ["telegeography-submarine-cables", "u"],
+  ["traffic", "t"],
+  ["transit", "j"],
+  ["weather-cyclones", "y"],
+  ["weather-lightning", "l"],
+  ["weather-radar", "v"],
+  ["weather-satellite", "o"],
+  ["wind", "k"]
+]