chore: improvement plans from audit

[johnx25bd]

This PR adds implementation plans from an automated codebase audit, for review and assignment. README.md under plans/ is the full index; 001–005 are self-contained executor specs.

Execution order & status

Plan	Title	Priority	Effort	Depends on	Status
001	Remove committed credentials file, close .gitignore gap (rotation = human follow-up)	P1	S	—	TODO
002	Add CI workflow: typecheck, lint, test, build on every PR/push	P1	S	—	TODO
003	Real EIP-712 verification for offchain attestations	P1	M	002	TODO
004	Reject unknown chains; single source of chain/contract truth	P2	M	002	TODO
005	Fix memo-less encoding failure + privateKey signer construction	P2	S	002	TODO

Full vetted findings table (top entries)

#	Finding	Category	Impact	Effort	Risk	Confidence	Plan
1	Security-sensitive finding — see plans/001-rotate-and-remove-committed-credentials.md for details (withheld here; this repo is public)	security	Credential compromise	S (+human rotation)	LOW	HIGH	001
2	No CI runs tests/lint/typecheck; release workflow publishes to npm without tests	tests/dx	Broken main can auto-publish; whole test suite provides no regression protection	S	LOW	HIGH	002
3	Offchain "verification" does no cryptographic check — forged attestations with arbitrary signer verify as valid	security	Nullifies the offchain trust model of the SDK's core product	M	MED	HIGH	003
4	Unknown chain name silently falls back to Sepolia at registration	bug	Attestations registered on the wrong network with no error	S	LOW	HIGH	004
5	ComputeModule keeps a divergent EAS contract-address map; unsupported chainId silently leaves EAS uninitialized	bug/debt	Address drift across 3 sources; misleading "Signer is required" failure	M	MED	HIGH	004
6	Memo-less attestations fail to encode (8 items vs 9-field schema)	bug	Documented-optional memo is effectively mandatory; happy path throws	S	LOW	MED-HIGH	005
7	privateKey config validated but never used to construct a signer	bug	Documented auth path fails later with misleading error	S	LOW	HIGH	005

Findings 8–25 (docs drift, tech-debt, perf, dependency items) and direction suggestions are recorded in full in plans/README.md, along with dependency notes and what wasn't audited.