fix: address review findings — CJS build (tsup), workflowCost signature, bottlenecks empty-graph test

- C1(critical): Replace tsc build with tsup for dual ESM + CJS output
- W2(warning): Change workflowCost to accept TaskGraph instead of TaskGraphInner
- S1(suggestion): Add test for bottlenecks empty-graph early return
- S2(suggestion): Document dangling-reference detection is unreachable via public API

test/analysis.test.ts

@@ -213,6 +213,12 @@ describe('bottlenecks', () => {
     expect(typeof bottlenecks).toBe('function');
   });
 
+  it('returns empty array for empty graph', () => {
+    const tg = new TaskGraph();
+    const result = bottlenecks(tg);
+    expect(result).toEqual([]);
+  });
+
   it('returns array of { taskId, score } objects', () => {
     const tg = TaskGraph.fromTasks([
       { id: 'A', name: 'Task A', dependsOn: [] },