Fix --quiet after subcommand, add cleanup command, finalize CHANGELOG

--quiet now works as both 'tracebit --quiet refresh' and
'tracebit refresh --quiet' by adding it to each subparser with
SUPPRESS default (doesn't override main parser when omitted).

Add test suite (45 tests, 100% pass)

Tests for all local modules: state, config, aws, and api (mocked HTTP).
Covers core logic, file permissions, edge cases, and error handling.
Add pytest as dev dependency, configure CI/release workflows to run tests.

and I fuck up the CI, again...