✨ Add @arethetypeswrong/cli (attw) as publish:attw

Validates the emitted .d.ts declarations against multiple TypeScript
module-resolution scenarios. Same rationale as publint: it validates
the publishable artifact, not the source, so it belongs in the
publish: prefix, not check:.

- Add publish:attw script using --profile esm-only (the package is
  intentionally ESM-only; CJS resolution is out of scope by design)
- Add step to CI publish job, after publish:publint and before
  npm publish
- Document the script and the esm-only rationale in project-specs.md
  and README.md
- Add 'attw' and 'arethetypeswrong' to cspell word list
- Remove unused 'stricter' word that was added speculatively before

project-specs.md

@@ -258,6 +258,14 @@ script does not belong in the standard pipeline.
   Called by the CI `publish` job immediately before `npm publish`
   (see §6). Not part of `npm run check` and not run on commit:
   it validates publishing correctness, not source correctness.
+- `publish:attw`: `attw . --pack --profile esm-only` — validates the
+  emitted `.d.ts` declarations against multiple TypeScript
+  module-resolution scenarios. Uses `--profile esm-only` because
+  this package is intentionally ESM-only (no CommonJS shim); CJS
+  resolution scenarios are explicitly out of scope by design, not
+  a bug. Called by the CI `publish` job alongside `publish:publint`
+  and `npm publish` (see §6). Not part of `npm run check` and not
+  run on commit: same rationale as `publish:publint`.
 
 ### HOOKS
 
@@ -279,9 +287,9 @@ script does not belong in the standard pipeline.
       `actions/checkout@v4`, `actions/setup-node@v4` (with
       `node-version-file: .node-version` and `registry-url`),
       `npm ci`, `npm run build`, `npm run publish:publint` (see
-      §5 for why this is `publish:` and not `check:`), and
-      `npm publish --access public` with `NODE_AUTH_TOKEN` from
-      secrets.
+      §5 for why this is `publish:` and not `check:`),
+      `npm run publish:attw`, and `npm publish --access public`
+      with `NODE_AUTH_TOKEN` from secrets.
 
 ## 7. Versioning & Publishing