Fix WS auth + gym release directive TypeScript error (#16)

* Fix WS auth: wire accessGate.allowUpgrade via verifyClient

The allowWs callback was never actually calling accessGate.allowUpgrade
during the WS handshake - the ws library passes (info) not (req), and
verifyClient must be set on the WebSocketServer constructor options.

Fix: pass verifyClient to WebSocketServer constructor and wrap
allowUpgrade to extract info.req.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Fix TypeScript error and add gym release directive support

Add "release" value to OfficeGymDirective type for symmetry with
OfficeQaDirective ("qa_lab" | "release"). Previously OfficeGymDirective
was only "gym" with no release state, making the "!== 'release'"
check in eventTriggers.ts dead code that TypeScript flagged as an
unintentional comparison.

Changes:
- deskDirectives.ts: add "release" to OfficeGymDirective type
- deskDirectives.ts: add gym release patterns to skill and command
  directive resolvers (e.g. "leave the gym", "done with skills")
- eventTriggers.ts: change !== "release" to === "gym" for clarity
  and consistency with reduceOfficeGymHoldState pattern

This fixes: https://github.com/iamlukethedev/Claw3D/issues/15

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

server/index.js

@@ -50,9 +50,9 @@ async function main() {
     },
     allowWs: (req) => {
       if (resolvePathname(req.url) !== "/api/gateway/ws") return false;
-      if (!accessGate.allowUpgrade(req)) return false;
       return true;
     },
+    verifyClient: (info) => accessGate.allowUpgrade(info.req),
   });
 
   await app.prepare();