[aolingge]

Cost reports omit nested snake_case usage tokens, misread uppercase JSONL exports, reject UTF-8 BOMs and can silently drop malformed records while reporting a passing budget. Count the supported nested token aliases, parse file extensions consistently, accept an initial BOM and warn that totals may be incomplete whenever JSON syntax fails. Valid records remain summarized; partial reports return 1 without copying invalid input text or inferring provider prices. Large event arrays are appended without argument-list limits.

Also replaces stale PR/CI/protection snapshots and pre-release reply placeholders with current maintainer documentation. A dependency and Action review guide distinguishes patch/minor/major changes, runtime evidence, exact-head checks and existing approval gates; README links it and the backlog reuses the existing release checklist.

Validation: four parsing regressions failed before the fix. Final whole-branch review found one large-array regression; its 150,000-event test was observed failing, then fixed by iteration. Actual Node 20.20.2 and 24.19.0 each pass all 39 tests; full lint/typecheck/build, scan smoke and whitespace checks pass. Existing cost/budget/CLI tests remain green. Public npm0.1.0/release/docs and relative links were checked for the documentation updates. No dependencies, actual workflows, protection or auto-merge settings changed; no real trace/provider, message, package or release publication was performed.