build(site): [SITE-07] reproduce complete Monaco contribution assembly

refactor/risks.json

@@ -652,11 +652,14 @@
         "refactor/changes/2026-09-15-SITE-07-monaco-core-origins.md",
         "refactor/baselines/monaco-core-build-provenance.json",
         "refactor/baselines/monaco-core-build-validation.json",
-        "refactor/changes/2026-09-15-SITE-07-monaco-core-build.md"
+        "refactor/changes/2026-09-15-SITE-07-monaco-core-build.md",
+        "refactor/baselines/monaco-contributions-provenance.json",
+        "refactor/baselines/monaco-contributions-validation.json",
+        "refactor/changes/2026-09-15-SITE-07-monaco-contributions.md"
       ],
       "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
       "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。",
-      "workspaceState": "Monaco 0.30.1 remains byte-pinned (the known CSS newline-only difference is preserved). Codicons 0.0.26 and the actual TypeScript 4.4.4 worker have original notice supplements. CSS/HTML/JSON workers, four mode bundles and all 76 basic-language bundles reproduce exactly; 2511 upstream plus 12 supplemental tokenizer cases pass in three engines. DOMPurify 2.3.1 and marked 3.0.2 now have exact npm-to-Git/source-map/development adaptations; the missing DOMPurify terms and original/legacy marked licenses are delivered. All 85 site notices and attribution links pass three-engine HTTP/mobile playback checks; Markdown formatting/filtering/hook cleanup also passes. Latest unit 18/18, strict type/lint and four-archive/seven-Git offline/network checks pass. The complete core compiler pipeline, other core/loader/localization and further embedded origins remain open; this is not an exhaustive sanitizer audit or release approval. All 13 core JavaScript minified outputs now reproduce with locked esbuild 0.12.6 on Windows x64; loader source/header and css/nls sources match fixed Git. Two maps inventory 584 prepared-source entries with 549 different names. Ten-locale editing/find checks pass 30/30 and core diff-worker checks pass 3/3; unit 20/20, type/lint and offline/network checks pass. Complete original TS compilation, appended contributions, CSS and remaining embedded origins are not claimed complete."
+      "workspaceState": "Monaco 0.30.1 remains byte-pinned, including its known CSS newline-only difference. Codicons 0.0.26, TypeScript 4.4.4 and language-service licenses are delivered. Three service workers, four modes and 76 basic-language bundles reproduce exactly; all 13 core JS minified outputs reproduce with locked esbuild 0.12.6 on Windows x64. Loader/header and css/nls source origins match fixed Git; two maps inventory 584 prepared-source entries and 549 different names. DOMPurify 2.3.1 and marked 3.0.2 have exact source adaptations and complete notice supplements; 85 site notices were verified by HTTP/mobile browser checks. Latest contribution check verifies six archives and 102 Git members, emits 88 TS registration modules and uses RequireJS 2.3.6/Terser 5.9.0 to reproduce the entire dev/min editor assembly, including core string-table entry, dependency injection, order, alias and map trailer. Latest units 23/23, strict type/lint and offline/network source checks pass; modes/tokenizer regressions pass 6/6 across three engines with 2523 token cases per engine. Earlier ten-locale editing/find 30/30 and diff-worker 3/3 evidence remains recorded separately. Original core TS compilation, CSS reproduction and remaining embedded-origin review stay open; this is not release approval or an exhaustive sanitizer audit."
     },
     {
       "id": "VENDOR-07",