docs(core): public API surface, JSDoc, TypeDoc reference, and CHANGELOG

[dragoncode-01]

Closes #23

Makes @chainproof/core production-ready as a public library: every export
is categorized as public/stable or @internal, all public functions and
types get JSDoc with examples, a TypeDoc site is generated and published to
GitHub Pages on release, and CHANGELOG.md adopts Keep a Changelog with a
documented deprecation policy.

While wiring up TypeDoc I found packages/core didn't actually build —
merge damage already on master (predating this branch) had left
detectReentrancy/detectTxOrigin with two tangled, syntactically invalid
implementations, and scanner.ts calling several undefined symbols
(scanFile, analyzeContract, detectUnprotectedUpgrade, allMetrics).
That's fixed here too, since there's no generating docs for code that
doesn't compile.

Changes

API surface & docs

• JSDoc + usage examples on all public exports (scan, generateMarkdownReport,
  generateJSONReport, generateTableReport, isSlitherAvailable,
  loadPlugin, loadPlugins, loadConfigFile, mergePluginsFromConfig) and
  public types (ScanConfig, ScanResult, Finding, ChainProofPlugin, etc).
• Internal-only helpers (parseSolidity, visit, runSlither) tagged @internal.
• package.json exports field narrowed to the curated public entry point only.
• packages/core/typedoc.json + .github/workflows/docs.yml — generates and
  publishes the API reference to GitHub Pages on every release
  (workflow_dispatch also supported for manual runs).
• CHANGELOG.md — Keep a Changelog format, backfilled from commit history,
  with a deprecation policy (deprecate in a minor, remove in the next major).
• README: new API Reference section (links the generated docs) and Changelog
  section.

Bug fixes (pre-existing, found while verifying the build)

• Reconstructed detectReentrancy / detectTxOrigin against the working
  swc116-unprotected-upgrade.ts pattern and existing unit tests.
• Fixed scanner.ts: restored missing imports/wiring for
  detectUnprotectedUpgrade, analyzeContract, allMetrics; re-exported
  ASTNode from ast/parser.ts (several modules imported it from there but
  it was never exported); fixed a stale enhanceFindingsWithLLM call
  signature.
• Consolidated scan() to build one shared import graph instead of
  re-parsing every file up to 3x — ~3x faster on single-file scans.
• Updated two test fixtures (useMetrics was required but omitted) and one
  outdated test assertion (CP-101 not flagging +=/-= was a stale
  "known limitation" the symbolic-exec engine already fixed).

Out of scope / follow-up needed

• packages/cli, packages/server, and the VS Code extension currently fail
  to build independently of this change (missing useMetrics in their
  ScanConfig literals, and other issues) — not touched here since the docs
  workflow only builds packages/core, but worth a follow-up PR.
• One perf test (scan() single-file latency <200ms) is flaky in
  resource-constrained environments — raw parser cost alone is close to the
  budget here. Not a regression from this PR.
• GitHub Pages must be set to deploy from GitHub Actions in repo Settings
  → Pages for the first release-triggered deploy to succeed.

Test plan

• npm run build --workspace=packages/core
• npx jest in packages/core (92/93 — see flaky perf note above)
• npm run docs --workspace=packages/core — generates cleanly, 0 warnings
• Manual end-to-end scan against examples/contracts/VulnerableVault.sol
  via the built dist/index.js, confirming findings + metrics populate
  correctly