Fix audit findings + add export command

[Booyaka101]

Implements fixes for a completed audit of gemcatch and adds the export command. Bumps to 0.3.0. No new dependencies.

All 50 offline checks pass (39 existing + 11 new), including new coverage for every finding below. Run with npm test.

Fixes (by audit number)

1 — HIGH: research --watch marked a live task failed on any poll error

• watchTask now rides out poll errors: a poll that throws is retried on the next interval (like watchBatch), and gives up only after GEMCATCH_WATCH_MAX_FAILS (default 10) consecutive failures.
• research's catch only marks the task failed when the submit failed (no interaction_id yet). Once submitted, a watch/poll error never overwrites the status, so the daemon keeps the task and collects the result.

2 — HIGH: a wedged/expired (404) interaction never retired

• In the poll path (refresh, shared by syncPass), a 404 retires the task locally: setStatus(id, 'incomplete', {error: 'interaction not found (expired or deleted)'}). It leaves the active set, so daemon --exit-when-idle converges.
• watchTask/watchBatch gained a safety bound: they stop with a clear message and non-zero exit after a bounded run of consecutive poll failures (or a stalled batch) instead of looping forever.

3 — MED: the default SDK transport was never tested

• Added an offline test that injects a stubbed @google/genai client and drives submit → poll → completed plus one friendly() error straight through sdkInteractions(), confirming shape() reads an SDK-shaped response (id, output_text, usage) and friendly() surfaces Google's real message.

4 — MED: prune -d <negative> deleted all finished tasks

• --days is validated Number.isFinite(days) && days >= 0; a negative or non-numeric value is rejected before the cutoff is computed.

5 — MED: a completed-but-empty result was never cached, then 404'd

• get and watch gate the cache hit on presence (result != null), not truthiness, so an empty-text completion is served from SQLite instead of re-polled.

6 — LOW/MED: batch dropped any line starting with #

• # is a comment only when followed by whitespace (/^#\s/), so #1 cause of X? survives. Skipped blank/comment lines are counted on stderr.

7 — smaller correctness

• watch -i / daemon -i reject non-positive intervals.
• list -n 0 returns zero rows (gate on != null); -n rejects negatives.
• A second daemon Ctrl-C force-exits (130).
• One-shot commands close the store on exit (no lingering -wal/-shm).
• stderr-written colour keys off process.stderr.isTTY (+ NO_COLOR), so redirecting one stream no longer strips/leaks ANSI on the other.
• README documents that GEMCATCH_RPM pacing is per-process.

8 — FEATURE: gemcatch export

• gemcatch export [--tag <t>] [--status <s>] [--format md|json] [-o <file>] — concatenate finished results, each under its prompt (with id/date), to stdout or a file. Default md. The "gather" that pairs with batch's "scatter".
• Bonus: gemcatch digest --tag <t> synthesizes a tag's completed results through one Gemini call; the summary lands under <tag>-digest.

Tests added

• Bump actions/checkout from 4 to 7 #1 poll error mid research --watch leaves the task active (not failed); a later get completes it.
• Bump actions/setup-node from 4 to 7 #2 a 404 retires the task to incomplete and daemon --exit-when-idle converges; a permanently-failing watch hits the safety bound (no infinite loop).
• Add batch command for fire-and-forget bulk research #3 SDK-path smoke via a stubbed @google/genai.
• Release 0.2.0 (batch command) #4 prune -d -5 rejected, deletes nothing.
• Fix audit findings + add export command #5 empty completed result served from cache without re-polling.
• Bump @google/genai from 2.12.0 to 2.13.0 #6 batch keeps #1 ..., skips # ..., reports the skipped count.
• chore(deps): bump better-sqlite3 from 12.11.1 to 13.0.1 #7 list -n 0 returns zero rows; watch -i -5 rejected.
• #8 export (md/json/-o) and digest.

Docs: README (export/digest, flag validation, per-process RPM note, 404 retirement) and CHANGELOG [0.3.0].

🤖 Generated with Claude Code