test: add credential-gated integration test against a live Pinecone index

[jhamon]

Theme: Testing + CI

Problem

The suite (tests/chunk|chunkedUpsert|csv|document|env.test.ts) is unit-only — it never exercises a real Pinecone upsert/query round-trip or the embedding pipeline. This is the exact gap that let bug #5 (a v2→v8 response-shape/deserialization mismatch) ship undetected; a unit test can't catch it, an integration test can.

Proposed fix

Add an integration test that, when PINECONE_API_KEY is present:

• creates a uniquely-named throwaway serverless index (respecting PINECONE_CLOUD/PINECONE_REGION),
• upserts a small batch via the real chunkedUpsert path,
• queries and asserts on the returned records' shape,
• tears the index down in a finally.

When the key is absent, the test self-skips (e.g. describe.skipIf(!process.env.PINECONE_API_KEY)) so local/PR runs stay green and credential-free. Harden against eventual consistency with polling/retries rather than fixed sleeps. Wire it into CI to run only on main/workflow_dispatch (credentialed), not on untrusted PRs.

Acceptance criteria

• Integration test exists and passes against a live index.
• Self-skips cleanly with no PINECONE_API_KEY; unit runs unaffected.
• Throwaway resources are uniquely named and always torn down.
• CI runs it only where the secret is available.

Blast radius

needs-verification

Dependencies

None — SDK is already on current stable (v8), so no upgrade prerequisite.