Add --bitgate-* theme tokens and a build-injected VERSION.

Widget styles now prefer --bitgate-* custom properties, falling back to the
deprecated --gov-* names and then the existing defaults so current pages and
overrides keep working. Browser bundles and ESM entry points expose VERSION
(and window.bitgate.version) from package.json. Document allowlist on the
widget policy preset list. Sync the lockfile so npm ci sees @bitgate/standalone.

Co-authored-by: thePR0M3TH3AN <[email protected]>

packages/widget/test/version.test.js

@@ -0,0 +1,28 @@
+// @vitest-environment happy-dom
+
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+import { VERSION, exposeBitGateVersion } from "../src/index.js";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const rootPkg = JSON.parse(readFileSync(join(HERE, "..", "..", "..", "package.json"), "utf8"));
+
+describe("VERSION", () => {
+  it("matches package.json", () => {
+    expect(VERSION).toBe(rootPkg.version);
+  });
+
+  it("is published on window.bitgate when the widget is imported", () => {
+    expect(/** @type {any} */ (window).bitgate.version).toBe(VERSION);
+  });
+
+  it("writes version onto an existing window.bitgate object", () => {
+    const target = { bitgate: { extra: true } };
+    exposeBitGateVersion(target);
+    expect(target.bitgate.version).toBe(VERSION);
+    expect(target.bitgate.extra).toBe(true);
+  });
+});