feat: add opt-in editable source handoff

[tt-a1i]

Summary

• add explicit --with-source support to archify render and archify deliver while keeping every default artifact source-free
• expose a bounded Export → Source JSON handoff backed by validated JSON, portable basenames, SHA-256 integrity, and SVG semantic binding
• fail closed for inherited environment flags, malformed or modified capsules, missing Web Crypto, and download errors
• document the user choice in the Skill and READMEs, then regenerate gallery, examples, proof reel, and archify.zip

Stability gates

• npm test — 437/437
• npm run test:webm — Share Card, Route Card, visual matrix, reduced motion, and 10/10 unique WebM frames
• Gallery — 11 artifacts / 99 checks
• Packaged ZIP — unzip -t, archify doctor, showcase delivery 9/9, poisoned-env demo source-free
• In-app browser — valid source download receipt passed; default, missing lanes, empty title, and digest mismatch stayed hidden/disabled; SVG export remained canonical
• Independent security/logic review — passed with no blockers or majors

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.