feat(i18n,a11y,dnd,media): graduate four modules toward Stable (#141–#144) - #157

- a11y-stable: coalesce optional activeElement id to '' so toContain
  receives a string instead of `string | undefined` (TS2769).
- dnd-stable: drop the unsupported `keyboard` option from the
  useSortable() call. sortable() is pointer-only; keyboard a11y lives on
  draggable, which the first test already covers (TS2353).

The PR's local `tsc --noEmit` used the default tsconfig (excludes tests/);
CI runs tsconfig.component-test.json, which includes them and caught this.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

… Stable (#145–#148) (#158)

Collected PR for the next four open stabilization tickets, implemented
on one branch.

> **Stacked on #157.** Base is set to the #157 branch so this diff shows
only the plugin/devtools/testing/storybook changes. It targets **dev**
after #157 lands (GitHub auto-retargets to `dev` when #157 merges).
Merge #157 first.

Closes #145
Closes #146
Closes #147
Closes #148

## #145 — plugin toward Stable: frozen extension contract

- New additive **`definePlugin()`** authoring helper (identity +
install-options inference) — a single, stable entry point for
third-party authors.
- Hook-bus / DI / install-lifecycle / directive-registration surface
frozen; **plugin-author guide** published (lifecycle, hook timing, DI
resolution, directive namespacing).
- **Install/uninstall symmetry** proven with tests: nothing a plugin
registers (directives, filters, actions, DI bindings) leaks after
`uninstall()`; re-install is clean.

## #146 — devtools toward Stable: bridge protocol + browser extension

- New stable, **versioned bridge protocol**: `connectDevtoolsBridge()`
(over `window.postMessage`), the transport-agnostic
`createBridgeServer()`, `serializeComponentTree()`, and
`BRIDGE_PROTOCOL_VERSION` / `BRIDGE_SOURCE` / `BRIDGE_CAPABILITIES`.
Built-in methods `ping` / `getSnapshot` / `getTimeline` /
`getComponentTree`; timeline events stream as `event` messages.
- Reference **Manifest V3 extension** in
[`extension/`](../tree/feat/plugin-devtools-testing-storybook-stable/extension)
(component tree, signal/store inspection, live timeline) that connects
over the protocol.
- `installBrowserBridge()` advertises the protocol version
(back-compatible).

## #147 — testing toward Stable: runner-agnostic + shadow-DOM parity

- Surface frozen; **runner integration beyond `bun:test`** documented
(Vitest / Jest) with `cleanup()` / `autoCleanup()` guidance.
- Shadow-DOM-aware `screen` / `within` queries, `userEvent` /
`fireEvent`, and a mock are **tested across light + shadow DOM**.
`expectAccessible` documented as sharing the a11y audit's rule
definitions.

## #148 — storybook toward Stable: pinned `unsafeHtml` contract

- Helper surface frozen; the **`unsafeHtml` security contract** is
pinned and documented — `storyHtml`/`storySvg` sanitize every
interpolation via the security module, and only brand-checked,
author-controlled fragments are inserted verbatim. Sanitization, the
bypass, brand-spoofing rejection, and each helper's output are covered
by tests.

## Shared / build

- README stability matrix, `introduction.md` stability paragraphs,
CHANGELOG, and `src/full.ts` exports (`definePlugin` + the devtools
bridge surface).

## Verification

- `bun test` — **2959 pass / 0 fail** (30 new tests across 4 files).
- `tsc --noEmit` clean; `check:doc-exports` 100% for
plugin/devtools/testing/storybook; `check:full-bundle` passes; eslint
clean; `build:lib` emits the devtools bundle.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <[email protected]>