## Summary

Describe what changed and why.

## Validation

- [ ] `npm run ci` passes locally
- [ ] Dist artifacts are rebuilt and included when source changes affect bundle output
- [ ] Documentation is updated when behavior or workflow changes

## Review Focus

- [ ] Runtime behavior parity is preserved
- [ ] Public script-tag contract remains stable
- [ ] Security-sensitive remote dependencies are pinned (no `@latest`)