Add --bitgate-* theme tokens and a build-injected VERSION.

Widget styles now prefer --bitgate-* custom properties, falling back to the
deprecated --gov-* names and then the existing defaults so current pages and
overrides keep working. Browser bundles and ESM entry points expose VERSION
(and window.bitgate.version) from package.json. Document allowlist on the
widget policy preset list. Sync the lockfile so npm ci sees @bitgate/standalone.

Co-authored-by: thePR0M3TH3AN <[email protected]>

scripts/esbuild-bitgate-version.mjs

@@ -0,0 +1,30 @@
+/**
+ * esbuild plugin: replace `@bitgate/core`'s version module with the value from
+ * package.json so browser bundles cannot drift from the package.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+/** @returns {string} */
+export function readLibraryVersion() {
+  return JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")).version;
+}
+
+/**
+ * @param {string} [injected]
+ * @returns {import("esbuild").Plugin}
+ */
+export function bitgateVersionPlugin(injected = readLibraryVersion()) {
+  return {
+    name: "bitgate-version",
+    setup(pluginBuild) {
+      pluginBuild.onLoad({ filter: /[/\\]core[/\\]src[/\\]version\.js$/ }, () => ({
+        contents: `export const VERSION = ${JSON.stringify(injected)};\n`,
+        loader: "js",
+      }));
+    },
+  };
+}