Strengthen public CLI diagnostics and release trust

[kopachlager]

What changed

• add a fast, formatter-verified README demonstration and clear CLI/hosted-service boundary
• clarify that compare inspects two HTTP user-agent responses and never executes JavaScript
• add explainable findings with stable codes, evidence, reasons, and restrained next steps
• add configurable text-ratio tolerance and separate response/metadata comparisons
• strengthen app-shell heuristics, URL error behavior, discovery validation, and JSON output
• add deterministic HTML and discovery fixtures plus a reproducible local demo
• expand command, safety, formatting, comparison, discovery, and fixture tests
• pin GitHub Actions, verify npm package contents, enable explicit provenance, and add release-note configuration
• add a restrained public roadmap and relevant package keywords

Product boundary

This remains a dependency-free diagnostic CLI. It does not run a browser, execute JavaScript, call private Prerender Buddy APIs, or expose rendering, proxy, routing, caching, monitoring, or infrastructure logic.

Validation

• 46 tests passing
• 99.18% line coverage / 92.93% branch coverage
• npm run check
• npm run pack:check (17-file allowlist)
• npm run demo:fixture
• npm audit --omit=dev (0 vulnerabilities)
• sensitive/internal-reference scan (no matches)
• git diff --check

Release note

This PR does not change the package version or publish an npm release.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8d6397c75b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Classify malformed redirects as request failures

When a valid public target returns a malformed Location header, fetchPublicText throws Invalid URL, so this broad message match reports invalid_input even though the caller's URL was valid and the remote response failed. JSON-mode automation may consequently tell users to correct their input instead of identifying a request failure; distinguish initial URL-validation errors from errors raised while resolving redirects.

Useful? React with 👍 / 👎.