feat: add v0.2.0 subgraph-first query layer (Baazaar + GBM)

[cinnabarhorse]

Summary

• ships aavegotchi-cli v0.2.0 subgraph-first query layer for Base-era reads
• adds generic subgraph command family:
  • ag subgraph list
  • ag subgraph check --source core-base|gbm-base [--raw]
  • ag subgraph query --source <alias> (--query|--query-file) [--variables-json] [--raw] [--timeout-ms] [--auth-env-var] [--subgraph-url --allow-untrusted-subgraph]
• adds Baazaar wrappers on core-base:
  • ag baazaar listing get --kind erc721|erc1155 --id <listingId> [--verify-onchain] [--raw]
  • ag baazaar listing active --kind erc721|erc1155 [--first] [--skip] [--raw]
  • ag baazaar listing mine --kind erc721|erc1155 --seller <0x...> [--first] [--skip] [--raw]
• adds GBM wrappers on gbm-base:
  • ag auction get --id <auctionId> [--verify-onchain] [--raw]
  • ag auction active [--first] [--skip] [--at-time] [--raw]
  • ag auction mine --seller <0x...> [--first] [--skip] [--raw]
  • ag auction bids --auction-id <id> [--first] [--skip] [--raw]
  • ag auction bids-mine --bidder <0x...> [--first] [--skip] [--raw]
• implements strict endpoint allowlist policy:
  • canonical aliases only by default
  • custom endpoint allowed only with both --subgraph-url + --allow-untrusted-subgraph
  • non-HTTPS custom endpoints rejected
• adds optional bearer auth injection from env (GOLDSKY_API_KEY default, override via --auth-env-var)
• adds onchain verify path for read wrappers with typed mismatch diffs (SUBGRAPH_VERIFY_MISMATCH)
• keeps existing mapped writes, onchain, tx, and baazaar read behavior unchanged
• bumps package version to 0.2.0
• adds docs:
  • docs/subgraph/endpoints-and-policy.md
  • docs/subgraph/query-matrix.md
  • CHANGELOG.md

Test Plan

• npm run typecheck
• npm test
• npm run build
• npm run parity:check
• npm run ag -- help

Live smoke (networked)

• npm run ag -- subgraph check --source core-base --json
• npm run ag -- subgraph check --source gbm-base --json
• npm run ag -- baazaar listing active --kind erc721 --first 3 --json
• npm run ag -- auction active --first 3 --json
• npm run ag -- baazaar listing get --kind erc721 --id 2705 --verify-onchain --json
• npm run ag -- auction get --id 5693 --verify-onchain --json

Preview

• N/A (CLI repository; no Vercel app)