Two audits, exact-revision CI gating, and a capture that got slower

Embedding-API and host-boundary audit findings are fixed, browser Worker smoke tests and a reference host adapter land, releases are gated on the exact tagged commit, and a fresh benchmark capture shows the cost of strict call order.

014c1b70 and cfb83cf3 fix the 11 September audit's embedding-API and host-boundary findings. b92a268c adds browser Worker smoke tests and a reference host adapter tested in real Chromium, Firefox and WebKit Workers. ab56a840 and 14770703 rework CI: exact-revision release gating, an accountable quarantine, scheduled security checks, and a minimum gate on push with the heavy suites as local commands and a weekly security run.

The canonical capture at 14770703 (zipp 0.0.15) is publishable and worse: headline ten rows at 1.003× Node against 0.878× on 2 September, with bytecode-vm at 3.59×. A paired A/B against the audited baseline puts the baseline within 1% of the new build on every row, so the regression opened earlier, and the suspect is v0.0.15's switch to specification-order method calls by default. The ledger records the trade instead of hiding the capture.

The first run on the newly pinned Test262 corpus also landed today: 95,665 of 95,680, then 95,669 after two JIT-only defects were fixed the same day.