feat!: add mixed model routing

[doedja]

What changed

• Replace permanent provider switching with process-scoped kenari claude and kenari codex wrappers.
• Add role-based native, fixed Kenari, picker, and inherit routing.
• Add private per-invocation router processes with IPC credential transfer, auth isolation, streaming, signal forwarding, and fail-closed behavior.
• Add version 2 config, model cache, migration backups, conflict handling, status checks, JSON output, reset, and logout.
• Remove kenari use and kenari key.
• Release package version 0.3.0.

Why

Native subscription models and Kenari models need to work in one session without writing Kenari credentials or provider settings into Claude Code or Codex configuration.

Breaking change

kenari use and kenari key no longer exist. Users configure roles with kenari configure, launch through the tool wrappers, and manage credentials with kenari login and kenari logout.

Validation

• node --test, 81 passing
• native-only cold launch through installed Claude Code 2.1.220 and Codex CLI 0.145.0
• Codex strict config validation for runtime overrides
• merged Codex native and Kenari catalog parsed by codex debug models
• npm pack --dry-run --json for @kenarihq/cli@0.3.0
• git diff --check