ci: add @arethetypeswrong/cli + fix dual ESM/CJS contract

Adds an attw guard to CI that catches future major bumps that silently
drop CJS (chalk@5 was the recent trigger; node-fetch, nanoid, unified
ecosystem are likely future suspects).

Adding attw also surfaced two latent bugs in the package shape that the
chalk downgrade alone didn't cover; fixed in the same PR so the new
check actually lands green:

1. `dist/index.js` was CJS code but Node 16+ treats every `.js` file as
   ESM because the root package.json has `"type": "module"`. tsup now
   emits `dist/index.cjs` and the exports map / `main` point there.
2. The exports map listed `types` after `import`/`require`, hitting the
   TypeScript fallback-condition bug (microsoft/TypeScript#50762). Now
   uses per-condition nested types so CJS consumers get `.d.cts` and
   ESM consumers get `.d.ts`.

Changes:
- `@arethetypeswrong/cli@0.18.3` as devDependency (pinned, no caret).
- `check:exports` script + `prepublishOnly` hook.
- CI step after build.
- `tsup.config.ts`: CJS extension `.js` → `.cjs`.
- `package.json` exports map: types-first, per-condition nesting.

This PR is based on top of #349 (chalk@4) so CI lands green. The same
attw step on top of master (chalk@5 + old exports map) goes red:
demo branch `claude/attw-demo-red`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: arturosdg

.github/workflows/integration.yml

@@ -19,3 +19,4 @@ jobs:
           npm ci
           npm run test
           npm run build
+          npm run check:exports