build(site): [SITE-07] reproduce historical Unicode data and ship source notices

refactor/risks.json

@@ -664,11 +664,14 @@
         "refactor/changes/2026-09-15-SITE-07-monaco-node-path.md",
         "refactor/changes/2026-09-15-SITE-07-monaco-dom.md",
         "refactor/baselines/monaco-dom-origins-provenance.json",
-        "refactor/baselines/monaco-dom-origins-validation.json"
+        "refactor/baselines/monaco-dom-origins-validation.json",
+        "refactor/changes/2026-09-15-SITE-07-monaco-unicode.md",
+        "refactor/baselines/monaco-unicode-provenance.json",
+        "refactor/baselines/monaco-unicode-validation.json"
       ],
       "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
       "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。",
-      "workspaceState": "Monaco 0.30.1 remains byte-pinned, including its known CSS newline-only difference. Codicons 0.0.26, TypeScript 4.4.4 and language-service licenses are delivered. Three service workers, four modes and 76 basic-language bundles reproduce exactly; all 13 core JS minified outputs reproduce with locked esbuild 0.12.6 on Windows x64. Loader/header and css/nls source origins match fixed Git; two maps inventory 584 prepared-source entries and 549 different names. DOMPurify 2.3.1 and marked 3.0.2 have exact source adaptations and complete notice supplements; 85 site notices were verified by HTTP/mobile browser checks. Latest contribution check verifies six archives and 102 Git members, emits 88 TS registration modules and uses RequireJS 2.3.6/Terser 5.9.0 to reproduce the entire dev/min editor assembly, including core string-table entry, dependency injection, order, alias and map trailer. Latest units 23/23, strict type/lint and offline/network source checks pass; modes/tokenizer regressions pass 6/6 across three engines with 2523 token cases per engine. Earlier ten-locale editing/find 30/30 and diff-worker 3/3 evidence remains recorded separately. CSS now reproduces from 68 styles, three embedded images and the copied font, with 81 verified Git members. The archived transport/plugin recipes match every prepared ESM stylesheet; explicit normalization of 70 generated CRLF separators reproduces the entire development CSS. cssnano 4.1.11/PostCSS 7.0.35 reproduce complete minified CSS using isolated frozen Yarn installs (153 selectors/143 versions) and historical browser defaults. The site retains its five header CRLF differences. The exact upstream stage that normalized the 70 development separators is still unidentified. Latest units 25/25, strict type/lint and offline/network checks pass; new three-engine style/theme/font/resize regressions pass 3/3. Original core TS compilation and remaining embedded-origin review stay open; this is not release approval or an exhaustive sanitizer audit. The Node path origin is now fixed to v14.16.0/bd60e93357a118204ea238d94e7a9e4209d93062 and the verified VS Code port. Its complete existing notice text matches both sources; a source supplement corrects the older index link without rewriting it. Six removed exports reproduce both source-map inputs; pinned TS 4.5.0-dev.20211021 emits exact full editor/worker modules. Thirty deterministic original Node path results pass in each browser engine, together with all 86 delivered notices and actual playback: 6/6 browser, 28/28 unit, type/lint, offline/network checks. Chromium retains one observed media ERR_ABORTED despite successful playback. Other embedded origins/full core compilation remain open. DOM helpers now bind six exact VS Code/source-map declarations and fixed WinJS4.4.5 comparison source/complete MIT terms to the unchanged editor; original adaptation version remains unknown, not inferred from that reference. Other origins and full original core compilation remain open."
+      "workspaceState": "Monaco 0.30.1 remains byte-pinned, including its known CSS newline-only difference. Codicons 0.0.26, TypeScript 4.4.4 and language-service licenses are delivered. Three service workers, four modes and 76 basic-language bundles reproduce exactly; all 13 core JS minified outputs reproduce with locked esbuild 0.12.6 on Windows x64. Loader/header and css/nls source origins match fixed Git; two maps inventory 584 prepared-source entries and 549 different names. DOMPurify 2.3.1 and marked 3.0.2 have exact source adaptations and complete notice supplements; 85 site notices were verified by HTTP/mobile browser checks. Latest contribution check verifies six archives and 102 Git members, emits 88 TS registration modules and uses RequireJS 2.3.6/Terser 5.9.0 to reproduce the entire dev/min editor assembly, including core string-table entry, dependency injection, order, alias and map trailer. Latest units 23/23, strict type/lint and offline/network source checks pass; modes/tokenizer regressions pass 6/6 across three engines with 2523 token cases per engine. Earlier ten-locale editing/find 30/30 and diff-worker 3/3 evidence remains recorded separately. CSS now reproduces from 68 styles, three embedded images and the copied font, with 81 verified Git members. The archived transport/plugin recipes match every prepared ESM stylesheet; explicit normalization of 70 generated CRLF separators reproduces the entire development CSS. cssnano 4.1.11/PostCSS 7.0.35 reproduce complete minified CSS using isolated frozen Yarn installs (153 selectors/143 versions) and historical browser defaults. The site retains its five header CRLF differences. The exact upstream stage that normalized the 70 development separators is still unidentified. Latest units 25/25, strict type/lint and offline/network checks pass; new three-engine style/theme/font/resize regressions pass 3/3. Original core TS compilation and remaining embedded-origin review stay open; this is not release approval or an exhaustive sanitizer audit. The Node path origin is now fixed to v14.16.0/bd60e93357a118204ea238d94e7a9e4209d93062 and the verified VS Code port. Its complete existing notice text matches both sources; a source supplement corrects the older index link without rewriting it. Six removed exports reproduce both source-map inputs; pinned TS 4.5.0-dev.20211021 emits exact full editor/worker modules. Thirty deterministic original Node path results pass in each browser engine, together with all 86 delivered notices and actual playback: 6/6 browser, 28/28 unit, type/lint, offline/network checks. Chromium retains one observed media ERR_ABORTED despite successful playback. Other embedded origins/full core compilation remain open. DOM helpers now bind six exact VS Code/source-map declarations and fixed WinJS4.4.5 comparison source/complete MIT terms to the unchanged editor; original adaptation version remains unknown, not inferred from that reference. Other origins and full original core compilation remain open. Unicode checkpoint reproduces RTL/Emoji predicates and all 5034 grapheme integers using mixed historical snapshots, matching both original maps and unchanged shipped editor/worker; complete historical Unicode terms and explicit source/version limitations are delivered. Other origins and full original core compilation remain open."
     },
     {
       "id": "VENDOR-07",