Extract shared Jev transports behind a Result API

[jkudish]

Summary

Introduce @jkudish/jev-agent-tools 0.1.0 as the shared, dependency-free Jev judgment wire layer. ask(input, config?) returns a typed success or rejection Result rather than throwing verdicts, so jev-browser can map failures to its own exception and jev-mcp can map them to invalid_response.

Lifted behavior

• Four run-bound carriers from jev-browser: TypeSafe, OpenRouter, Cloudflare, and Vercel AI Gateway. TypeSafe and Vercel use equivalent direct-fetch wire requests instead of SDK runtime dependencies.
• Strict provider registry with injectable env, original precedence, forced-provider diagnostics, and no unknown-provider fallback.
• Fail-closed answer, distribution, usage, and model validation with original tolerances, plus safe error messages and reserved-ID preservation.
• Hermetic transport corpus adapted to Result assertions; optional gated real TypeSafe smoke in CI. No Playwright browser integration test.

Verification

• npm run typecheck and npm run build: pass.
• npm test: 11/11 hermetic tests pass.
• npm run test:live: 1/1 real TypeSafe judgment passes locally; CI self-skips without the repo secret.
• npm pack --dry-run --json: includes generated JS and declarations.
• README.md and CHANGELOG.md em-dash counts: 0 and 0. git diff --check: clean.
• Oracle approved on round 3 after addressing reserved object keys and separating the live test.

Task #4003. No publish, tag, release, or consumer repository changes. Do not merge without Joey approval.