fix: address review findings — CJS build (tsup), workflowCost signature, bottlenecks empty-graph test

- C1(critical): Replace tsc build with tsup for dual ESM + CJS output
- W2(warning): Change workflowCost to accept TaskGraph instead of TaskGraphInner
- S1(suggestion): Add test for bottlenecks empty-graph early return
- S2(suggestion): Document dangling-reference detection is unreachable via public API

test/subgraph-and-validation.test.ts

@@ -420,6 +420,11 @@ describe('validateGraph', () => {
     expect(danglingErrors).toHaveLength(0);
   });
 
+  // Note: dangling-reference detection (lines 78-93 in validation.ts) is unreachable
+  // through the public API because graphology's mergeEdge auto-creates missing nodes
+  // and addEdgeWithKey rejects non-existent source/target. The code is a defensive
+  // guard for direct raw graph mutation that bypasses TaskGraph invariants.
+
   it('detects multiple independent cycles', () => {
     // Create a graph with two independent cycles
     const data: TaskGraphSerialized = {