docs: add conventional status badges to the READMEs

[github-actions]

Closes #54

loop-task: #54

Why

Issue #54 asks for the common README badges. Today README.md carries only the npm-version badge and README_zh-CN.md has none.

What

One badge row directly under the # tiny-oss heading in both README.md and README_zh-CN.md (parity), keeping the existing npm-version badge and adding the conventional set:

badge	image	links to
npm version (existing)	npm/v	npm package
npm downloads	npm/dm	npm package
license	npm/l	LICENSE on main
CI	Actions badge for ci.yml	Actions workflow page
bundle size (minzip)	bundlephobia/minzip	Bundlephobia package page
Node engine	node/v	npm package

Docs-only: no source, dependency or workflow file change; commit type docs per AGENTS.md.

Verification

• Every badge image URL and link target returns HTTP 200 from the runner (npm/v, npm/dm, npm/l, bundlephobia/minzip, node/v, the ci.yml Actions badge; LICENSE, Actions page, Bundlephobia page).
• pnpm lint — 0 errors (39 pre-existing warnings).
• pnpm fmt:check — all files formatted.
• pnpm build then pnpm check:types — exit 0 (check:types reads the generated dist/ types).
• pnpm test:azure-oracle — all checks passed.
• pnpm exec vitest run --browser.headless with pnpm serve — 22 files passed, 231 passed / 26 skipped (integration specs skip without credentials).

Review

Two-lens review (correctness/regression and standards/safety) found no L1/L2 problems; the independent pr-review stage re-checks the diff.

[github-actions]

Coverage

Metric	%	Covered / Total
Lines	90.19%	1003/1112
Statements	89.06%	1083/1216
Functions	91.03%	193/212
Branches	76.43%	519/679

[github-actions]

Loop pr-review — approve ✅

Independent check of the diff (README.md +5, README_zh-CN.md +7), separately from the feature (maker) run:

• Correctness/regression — implements List the common badges in readme file #54's triage scope exactly: one badge row under # tiny-oss in both READMEs, keeping the npm-version badge and adding downloads, license, CI, bundlephobia minzip and Node. All six badge images and the LICENSE / Actions / Bundlephobia link targets return HTTP 200 from the runner (npmjs.com 403s to curl as before — bot protection; it is the same URL the pre-existing badge links). No source, dependency or workflow file changed, so signers and tree-shaking are unaffected.
• Standards/safety — docs commit type per AGENTS.md; no secrets or dangerous patterns; README_zh-CN.md kept in parity; badge labels in English per the shields convention.

Gates re-run from this checkout: pnpm lint 0 errors (39 pre-existing warnings), pnpm fmt:check clean, pnpm build + pnpm check:types exit 0, pnpm test:azure-oracle passed, browser suite 22 files / 231 passed / 26 skipped. CI Lint and Test are green on this head.

No L1/L2 problems. Awaiting the owner's approving review and merge.