feat: add public Special Situations SDK workflows

[daniel-scrivner]

Summary

• Adds typed, public Special Situations discovery, archive, export, underwriting, paid RSS, and watch workflows in @secapi/sdk-js@1.2.0.
• Mirrors the deployed authenticated operation metadata for all 14 public /v1/situations* routes.
• Keeps TIKR-style data strictly out of this public SDK.

Production Contract Validation

• Authenticated production list/detail probes confirm providerKey is public on Situation and SituationEvent responses.
• Production does not emit sourceRights, provenance, freshness, materialization, methodology, or revision on those objects; the SDK no longer requires them.
• Production OpenAPI declares API-key/Bearer security and x-secapi-route-id, access, kind, docs, and smoke metadata for every public situations route. It does not declare a speculative meter extension.

Validation

• bun test (101 passing)
• bun run typecheck
• bun run build
• npm pack --dry-run
• git diff --check
• Authenticated production response parsed by the updated situationListSchema

Completion Attestation

• Scoped implementation contains only public Special Situations SDK work.
• No secrets, machine-specific paths, or internal TIKR surface were introduced.
• Two-pass GPT-5.5 High adversarial review completed.

Adversarial Review Record

1. Pass 1:
   • Accepted: production response metadata was incorrectly required by the SDK; removed it.
   • Accepted: OpenAPI operation metadata was missing; mirrored the deployed public metadata.
   • Rejected with live proof: the claim that providerKey is internal-only. Authenticated production responses include it, so the SDK preserves it.
2. Pass 2:
   • PASS. No material release blocker; confirmed the corrected wire contract, route metadata, and no internal/TIKR expansion.

Ready for review and merge.