standalone: ship the headless engine as one bundleable ESM file

A no-build static site couldn't vendor BitGate the way it vendors a single
dependency: bare @bitgate/* specifiers don't resolve in a browser, and the
headless path spans two packages (the evaluator in core, the kind-1985 label
codec in nostr). The widget bundle solved this for the DOM path only.

Add @bitgate/standalone (packages/standalone): an entry re-exporting core +
nostr, esbuilt into a single self-contained dist/bitgate.js (~44 KB). It's
the same canonical code the npm packages ship, with specifiers inlined, and
dependency-free -- @bitgate/verify's @noble deps are intentionally not pulled
in, so the bundle carries no third-party code. Wired into `npm run build` via
build:standalone.

Verified: no bare imports in the output (self-contained), and a smoke test
composes a full label -> decision flow from the single entry. README Packages
table and headless section document it.

Addresses the "standalone ESM single-file" item of the Tessera integration
feedback (docs/TODO.md).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01BXQCvJPA6sVSQ5j8uBd9bB

docs/TODO.md

@@ -273,8 +273,14 @@ adoption the obvious choice.
 
 ### Medium
 
-- Ship `@bitgate/core` as a standalone ESM single-file (like BitFeed's
-  `standalone`) so a no-build static site can vendor it the way we vendor
-  `@tessera/core`. Dependency-free + no build step was a hard requirement for us.
+- **[DONE 2026-08-11]** Ship a standalone ESM single-file. **Shipped**
+  `@bitgate/standalone` (`packages/standalone/`, `npm run build:standalone` →
+  `dist/bitgate.js`, ~44 KB): the headless engine (core) + the Nostr codecs
+  (nostr, incl. the kind-1985 label round-trip) esbuilt into one self-contained,
+  dependency-free ESM file — `@bitgate/verify`'s @noble deps are deliberately
+  not pulled in. A no-build static site vendors the single file and gets the
+  whole headless path. Verified dependency-free (no bare imports in the output)
+  and end-to-end (a smoke test composes a decision from the entry). Documented
+  in the README Packages table and the headless section; wired into `npm run build`.
 - A worked example of BitGate feeding a feed ranking (the `ranking` dimension →
   a score multiplier) would have saved us reinventing it in the feed recipe.