Let an agent report a bug without leaving the shell

[kev1n]

The gateway shipped bug-report and feedback intake in anyapi#650, live in production as of this PR. This adds the two CLI commands that reach it.

Commands

• anyapi report-bug <summary> - a wrong or empty result, a misleading error, a price that looks off.
• anyapi feedback <summary> - a missing API, a missing field, confusing docs.

Both take --details, --sku, --request-id, --contact. Both are free and never charged.

Two commands rather than one with a --kind flag: the route stamps the kind server-side, so neither command takes a kind argument and a caller cannot mislabel its own message.

Ecosystem classification

Class: CLI plus customer-facing copy, per ECOSYSTEM.md. These are not discovery commands, so the handwritten discovery reader, its contract, and the live reader canary are untouched.

Surface	Decision
CLI discovery transport	Unaffected - src/discovery.ts and every catalog/search/describe path unchanged
CLI commands	Updated - two new non-discovery commands
Bundled task skills	Updated - anyapi-run gains a "When a result looks wrong" section; anyapi-discover and anyapi-onboarding document no command this PR changes
README	Updated - both commands documented under Commands
SDKs / n8n / OpenAPI	Unaffected - no wire this repo publishes changed
Rollout order	Gateway first (already deployed and verified), CLI second (this PR), then the main repo's skill and Mintlify copy

Deviations worth flagging

• --request-id does not default to the newest saved run. Silently attaching a possibly unrelated call degrades the exact field the feature exists to improve. The commands print a one-line nudge when no id was given.
• --version reported 0.5.0 while package.json was 0.7.0. Pre-existing drift, fixed here rather than left alone: the CLI version is the first thing anyone triaging one of these reports checks, so shipping a bug-report feature on top of a self-misreporting binary would poison the reports it collects. Bumped to 0.8.0 with the release.
• requireApiKey is now exported from src/commands.ts so src/feedback.ts resolves a key through exactly that path, including its offer to mint a trial key rather than dead-ending.

Proof

npm run build && npm test green, 96 tests across 11 files, 8 of them new for these commands: route-per-kind, no kind in the body, option pass-through and omission, auth header, blank-summary rejection before any request, the conditional tip, and the gateway limit message surfacing rather than a bare status.

Verified against production with the built dist/, after anyapi#650 deployed:

• anyapi --version prints 0.8.0
• anyapi report-bug " " rejects client-side, exit 1, no request sent
• anyapi feedback "..." returned Feedback filed. Reference: 11861ad2-2b66-4eae-b36d-b8d7f819d0f9

That last one wrote a real row, labeled "Deploy verification for anyapi#650 - safe to delete this row".