feat: add strength reports and safe exports

[asimawdah]

Summary

Closes #7.

Rebuilds the strength-report/export work on top of the current main after the older PR became non-mergeable.

Changes

• Adds --report for readable strength reports on stderr while preserving stdout for CLI scripting.
• Adds --format json with schema metadata, entropy, strength, warnings, recommendations, and enabled-set coverage data.
• Adds --redact for shareable JSON metadata.
• Adds --output, --quiet, and --force for safer local exports with extension checks, overwrite protection, parent-directory handling, and owner-only file permissions where supported.
• Preserves the existing validation/security improvements from main, including strict option validation, positional preset validation, recovery hints, and enabled-set coverage guarantees.
• Documents report/export usage in README and docs/STRENGTH_REPORTS.md.
• Adds expanded smoke tests for reports, JSON metadata, redaction, and safe exports.
• Pins yargs to the Node 18-compatible ^17.7.2 line.
• Strengthens CI so it runs syntax validation plus CLI smoke tests and static contract/checklist guards across Node 18, 20, and 22.
• Restores the SECURITY.md public-issue guidance phrase required by the validation contract.

Current verification

• Latest head: 48b634add0bb89b9bb54e175fbca45501fabae1e.
• Fixed the smoke-test failure from CI run 28635014960: the failing assertion expected bare --length to fail, but the pinned yargs behavior treated it as absent. The smoke test now avoids that version-sensitive missing-value assertion while retaining invalid numeric length, coverage, unknown option, mode, output, JSON, redaction, quiet, and help coverage.
• Fixed the validation-contract failure from CI run 28635912132: SECURITY.md now includes the required "Do not paste generated passwords into GitHub issues" guidance while preserving broader secret-handling warnings.
• Latest CI run for the new head: 28636621882 succeeded across Node 18, Node 20, and Node 22.
• GitHub reports mergeable: true.

Notes

• Supersedes feat: add strength reports and exports #10, which was closed because it became non-mergeable and duplicated this same Feature: Add password strength report and export options #7 review path.
• No merge was performed.