deps: bundle the AIModels submodule and automate catalog releases

[mitkury]

Catalog edits currently require publishing aimodels to npm or managing a sibling-repository link before AIWrapper can use them. This replaces that dependency with an editable aimodels/ Git submodule, pinned to upstream commit 5d646aff26f93fc8b3304f2645d99827e45601ba (package version 0.7.0).

The build validates and compiles the upstream catalog, then ships its JavaScript, declarations, and MIT license inside AIWrapper. Consumers continue importing models, Model, and other catalog APIs from aiwrapper, without fetching aimodels or needing Git. Developers can edit aimodels/data/ or aimodels/js/src/ and run npm run aimodels:build; the playground uses that generated catalog too. A separately installed aimodels package now has its own catalog instance and class identity.

Automatic updates

• Check upstream main hourly, with optional repository dispatch and manual triggers. Documentation-only changes do not cause releases.
• Reject dirty or diverged local history and skip repeated or older revisions.
• For relevant updates, advance the submodule, bump AIWrapper's patch version, verify the package and playground, then atomically push the release commit and tag.
• Explicitly dispatch publish.yml at the tag, since GITHUB_TOKEN-created tag pushes do not trigger another workflow. Verify tag/version agreement, skip already published versions, and support recovery when dispatch or publication fails.

CI initializes submodules. The former npm-link scripts and dependency-update workflow are replaced, and developer documentation covers editing and committing in both repositories. Website automation is outside this change.

Validation

Verified from a fresh clone with the proposed patch applied, submodules initialized from GitHub, and clean dependency installations:

• npm run check: 115 upstream catalog tests, 186 AIWrapper tests, and a packed npm consumer runtime/TypeScript check.
• npm run check:playground: zero type-check errors or warnings, 35 tests, and a production browser build.
• actionlint, JavaScript syntax checks, and git diff --check passed.
• The real updater reports no change for the current upstream revision. Nine updater tests cover advancement, idempotency, stale notifications, local edits, divergence, ref validation, and changes outside upstream main.

The automation becomes active after merge. npm must trust mitkury/aiwrapper / publish.yml with direct publishing allowed. Inspection of that account setting required npm MFA, so it has not been verified in this session. No npm release was performed.