feat(widget): plug-and-play governance UI as custom elements

Follows bitlogin's layering: the engine stays headless and the widget is a
consumer of the published API, never a dependency of it. Building it was also a
test of that API — an element needing something unexposed would have been a
finding, the way the commerce example was.

Viewer elements: governance-veil (blur on restrict, disclosure on hide, warning
on warn), governance-report, governance-status. Moderator elements:
governance-capabilities, governance-action, governance-admin-panel.

Deliberate behaviors:
- hidden content leaves the accessibility tree rather than being visually
  covered, so a screen reader does not read out what the viewer must not see
- a hidden decision renders a disclosure, not nothing: content that silently
  vanishes is indistinguishable from a bug and leaves no route to appeal
- refused moderator actions stay visible and name the missing capability. A
  hidden button teaches nothing about the authority model, and the command
  layer enforces the same check independently — the UI is an explanation,
  never the gate
- no element computes policy; wording maps from stable reason identifiers and
  is overridable per application

Found while building it: GovernanceAdminStore emitted only when reduced denial
state changed, so revoking a role that denied nobody announced nothing, leaving
capability-gated UI and the decision cache stale.

The root tsconfig deliberately omits the DOM lib — that absence is what keeps
core, nostr, and runtime from reaching for browser globals — so the widget
carries its own DOM-aware config rather than relaxing the guarantee globally.

687 tests; lint, typecheck, and the declaration build pass from a cold checkout.

README.md

@@ -45,6 +45,7 @@ equivalent to following the operator's seed list.
 | `@nostr-governance/nostr` | Codecs: canonical v1, NIP-56, NIP-51, legacy lists, bech32. |
 | `@nostr-governance/runtime` | Stores, transport orchestration, commands. |
 | `@nostr-governance/testing` | Conformance harness. |
+| `@nostr-governance/widget` | Drop-in custom elements: viewer controls and a moderator console. |
 | `@nostr-governance/bitvid-compat` | Reference application profile for the characterization corpus. |
 
 ## Quick start
@@ -116,6 +117,30 @@ address denial that survives republication, malware-driven checkout blocking,
 capability-scoped moderator roles, community curator ingestion, and
 seller-facing explanations. See [`docs/integration-guide.md`](docs/integration-guide.md).
 
+## Plug-and-play UI
+
+`@nostr-governance/widget` ships custom elements that render decisions and issue
+commands — and compute no policy of their own:
+
+```html
+<governance-veil profile="feed"><img src="thumbnail.jpg" alt="" /></governance-veil>
+```
+
+```js
+import { defineGovernanceElements } from "@nostr-governance/widget";
+defineGovernanceElements();
+
+const veil = document.querySelector("governance-veil");
+veil.runtime = runtime;
+veil.target = { type: "event", id, author };
+```
+
+Viewer elements (`governance-veil`, `governance-report`, `governance-status`)
+and moderator elements (`governance-capabilities`, `governance-action`,
+`governance-admin-panel`) are separate, so a site embeds only what it needs.
+See [`packages/widget/README.md`](packages/widget/README.md) and the runnable
+[`examples/commerce/demo.html`](examples/commerce/demo.html).
+
 ## Authority model
 
 Root-authorized contributors: the root publishes the role roster, each actor