Add --bitgate-* theme tokens and a build-injected VERSION.

Widget styles now prefer --bitgate-* custom properties, falling back to the
deprecated --gov-* names and then the existing defaults so current pages and
overrides keep working. Browser bundles and ESM entry points expose VERSION
(and window.bitgate.version) from package.json. Document allowlist on the
widget policy preset list. Sync the lockfile so npm ci sees @bitgate/standalone.

Co-authored-by: thePR0M3TH3AN <[email protected]>

packages/standalone/test/standalone.test.js

@@ -2,10 +2,16 @@
 // engine (core) + label codec (nostr) — so a no-build site gets everything from
 // the single bundled file. Tests the entry, not the built artifact (dist is
 // gitignored); the build itself is exercised by `npm run build:standalone`.
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
 
 import * as bitgate from "../src/index.js";
 
+const HERE = dirname(fileURLToPath(import.meta.url));
+const rootPkg = JSON.parse(readFileSync(join(HERE, "..", "..", "..", "package.json"), "utf8"));
+
 describe("standalone entry surface", () => {
   it("re-exports the core engine and the Nostr label codec together", () => {
     for (const name of [
@@ -17,6 +23,7 @@ describe("standalone entry surface", () => {
       "createPolicyDefinition",
       "createEventTarget",
       "ALLOWLIST_POLICY",
+      "VERSION",
       // nostr label codec
       "decodeLabels",
       "encodeLabel",
@@ -67,4 +74,15 @@ describe("standalone entry surface", () => {
 
     expect(decision.transaction?.effect).toBe("deny");
   });
+
+  it("exports VERSION matching package.json", () => {
+    expect(bitgate.VERSION).toBe(rootPkg.version);
+  });
+
+  it("publishes version onto a window-like global without replacing other keys", () => {
+    const target = { bitgate: { extra: true } };
+    bitgate.exposeBitGateVersion(target);
+    expect(target.bitgate.version).toBe(bitgate.VERSION);
+    expect(target.bitgate.extra).toBe(true);
+  });
 });