Fix release-blocking package and privacy boundaries

[0thernet]

Summary

• preserve production browser eligibility in the built client and make React reuse the client singleton through a stable ./client.js seam
• move delegated DOM parsing to the browser export, classify owned targets, omit foreign paths, redact URI userinfo, and preserve exact allowed-host ownership
• prune expired exception fingerprint buckets and make all published source types pass Bundler and NodeNext resolution
• strengthen generated-boundary checks and packed Node 24 consumer smoke coverage

Verification

• bun run check
• 29 deterministic tests and 4 property tests pass
• packed artifact imports under Node 24 and typechecks as both Bundler and NodeNext
• public-boundary and KB/agent-guide checks pass

No tag, release, merge, or consumer migration is included.