feat: add public Special Situations CLI workflows

[daniel-scrivner]

Summary

• Adds public Special Situations commands for discovery, archive, underwriting, source-cited export, paid RSS, and durable monitoring in @secapi/cli@1.3.0.
• Uses only the paid/public /v1/situations* and /v1/monitors contracts; no TIKR-style internal surface is exposed.
• Makes organization-fanout prerequisites explicit and regression-tests the weekly archive and underwriting routes.

Production Contract Validation

• Authenticated production probes confirmed /v1/situations/issues is a live paid archive route (currently zero issues rather than a false endpoint) and /v1/situations/:id/underwriting-pack returns a source-cited pack.
• Current server contracts allow exact situationIds and typed email or acknowledged organization-webhook fanout for structured situation monitors.

Validation

• bun test
• bun test src/index.test.ts --test-name-pattern "CLI Special Situations" (8 passing)
• bun run typecheck
• bun run build
• npm pack --dry-run
• git diff --check
• Production read-only route probes

Completion Attestation

• Scoped implementation contains only public Special Situations CLI work.
• No secrets, machine-specific paths, or internal TIKR surface were introduced.
• Two-pass GPT-5.5 High adversarial review completed.

Adversarial Review Record

1. Pass 1: no material CLI release blocker found.
2. Pass 2:
   • Rejected with current source and production proof: the claim that issue/archive, underwriting, exact situation IDs, and organization fanout are non-contract surfaces.
   • Accepted: clarify the active organization delivery-target prerequisite and add direct regression tests for archive and underwriting command routes.

Ready for review and merge.