Sprint 10: harden v0.1 release candidate - #25

Summary

• freeze the v0.1 runtime/package API and set the package version to 0.1.0
• add a standalone browser ESM artifact with real Chromium smoke coverage
• enforce exact npm payload, zero runtime dependencies, license and vulnerability audits
• build versioned npm/browser artifacts with commit-bound SHA-256 checksums
• prove artifacts reproducible across two detached clean worktrees
• document compatibility, security, licensing, release, and Trusted Publishing contracts
• add tag-gated npm Trusted Publishing with OIDC provenance (no token and no publication performed)

Validation

• release:check: 14/14 stages passed
• Vitest: 27 files, 235 tests
• bounded fuzz smoke: 250 iterations, seed 20260825
• Chromium browser artifact smoke: passed
• npm payload: 9 files, 0 runtime dependencies
• license audit: 172 dev packages
• npm audit: 0 vulnerabilities
• reproducibility: 2/2 clean builds byte-identical
• checksums: verified for both artifacts

Closes #17
Closes #18
Closes #19
Closes #20
Closes #21
Closes #22
Closes #23
Closes #24