Sprint 15.1 — Vendor and pin secure-metadata v0.1.0

[maruson08]

Problem / motivation

Secure Tools needs an auditable, immutable browser metadata dependency without npm, CDN, rebuild, or runtime network loading.

Scope

Download the v0.1.0 GitHub Release browser artifact and checksum manifest, verify SHA-256, and vendor the unchanged artifact with tag-sourced LICENSE, package metadata, and provenance README.

Non-goals

No rebuild from Secure_Metadata main, source tree, tarball, source map, updater, or runtime fetch.

Acceptance criteria

• Vendored browser artifact SHA-256 is exactly 8d0b8a1addf904760aa1f52378fb05eed6540520cb05fe2320d77011cba69c28.
• Vendor directory contains only the approved four files.
• README records version, tag, release commit, artifact, hash, license, dependency count, integration, and upgrade policy.
• Release-gate tests detect binary and provenance drift.

[maruson08]

Completed by PR #29, merged into the v2 integration branch at 82f09e8. GitHub did not apply the closing keyword automatically because v2 is not the repository default branch.