fix: make unlisted shares agent-readable by default

[notsuhas]

Summary

• make active unlisted share URLs readable by no-install agents through a generated content URL advertised in HTML and the HTTP Link header
• default new CLI deployments to unlisted, while replacements without --visibility preserve the existing tier
• keep explicit unlisted, private, members, and team behavior and protected-link authentication unchanged
• update CLI help, README, canonical skill, and generated agent docs

Security

• only active unlisted sites receive the public alternate link
• uploaded bytes remain on the isolated content origin; the app shell contains escaped metadata and a generated URL only
• private, members, team, archived, and missing-site access behavior is unchanged
• routine CLI redeploys cannot silently re-tier existing sites

Verification

• bun run test (API: 1351 passed, 0 failed; web and npm suites passed)
• bun run typecheck
• bun run lint
• bun run format:check
• (cd packages/cli && go test ./...)
• explicit create and replacement tests cover all four visibility tiers
• independent code review: findings addressed; final verdict ready to merge
• GitHub CI: build and CLI checks passed