Fix WS auth + gym release directive TypeScript error (#16)

* Fix WS auth: wire accessGate.allowUpgrade via verifyClient

The allowWs callback was never actually calling accessGate.allowUpgrade
during the WS handshake - the ws library passes (info) not (req), and
verifyClient must be set on the WebSocketServer constructor options.

Fix: pass verifyClient to WebSocketServer constructor and wrap
allowUpgrade to extract info.req.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Fix TypeScript error and add gym release directive support

Add "release" value to OfficeGymDirective type for symmetry with
OfficeQaDirective ("qa_lab" | "release"). Previously OfficeGymDirective
was only "gym" with no release state, making the "!== 'release'"
check in eventTriggers.ts dead code that TypeScript flagged as an
unintentional comparison.

Changes:
- deskDirectives.ts: add "release" to OfficeGymDirective type
- deskDirectives.ts: add gym release patterns to skill and command
  directive resolvers (e.g. "leave the gym", "done with skills")
- eventTriggers.ts: change !== "release" to === "gym" for clarity
  and consistency with reduceOfficeGymHoldState pattern

This fixes: https://github.com/iamlukethedev/Claw3D/issues/15

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

server/gateway-proxy.js

@@ -87,11 +87,13 @@ function createGatewayProxy(options) {
     logError = (msg, err) => console.error(msg, err),
   } = options || {};
 
+  const { verifyClient } = options || {};
+
   if (typeof loadUpstreamSettings !== "function") {
     throw new Error("createGatewayProxy requires loadUpstreamSettings().");
   }
 
-  const wss = new WebSocketServer({ noServer: true });
+  const wss = new WebSocketServer({ noServer: true, verifyClient });
 
   wss.on("connection", (browserWs) => {
     let upstreamWs = null;