Summary

Adds base44.experiments for browser feature-flag reads, auth-aware readiness/subscriptions, and experiment exposure tracking. Draft pending platform integration and complete validation; no stable package release or dependency changes.

Intent (for reviewers & PR Autofix)

What this PR does

Adds SDK-owned experiment evaluation for browsers and request-scoped Workers, common-auth reactivity, hydration snapshots and acknowledged exposure delivery.

Key decisions & why

• Public bootstrap/request context supplies configuration; no per-decision fetch or experiment-specific auth lookup. Snapshot observation never records exposure.
• Legacy browser evaluation requires the client's app ID to match the companion bootstrap, on both activation and auth updates. Missing or foreign ownership returns fallbacks without experiment exposures.
• Preview intent is captured on goals at track-time; server Analytics state is per-client. Ordinary Analytics remains best-effort.
• Stable exposure ID, timestamp and credential survive bounded, memory-only retries.

What NOT to touch

The gateway-check workflow is intentionally unchanged from the PR base. Its unrelated action-pinning fix was removed at the author's request; handle any recurrence of that workflow's pre-existing startup failure separately, not by reintroducing it here.

No version, dependency or lockfile changes. Context headers are not authentication: ingress must strip/rebuild them. Public SDK API availability is not experiment enrollment. The Builder rollout flag is not a runtime kill switch. This fix intentionally leaves the existing Analytics visitor-only observer unchanged.

Tradeoffs / follow-ups

Isolation fix 55202d3 adds permanent regressions for foreign/unidentified runtimes and auth updates. Supplemental local verification: 105 focused tests and scoped TypeScript passed, using existing non-lock-exact dependencies. Locked CI on SDK implementation head 55202d3 passed 382 tests, type checks, lint and dependency audit; the preview package also built and published successfully. Shared Analytics changes still affect SDK upgraders without experiments and need release sign-off. Stable publication, production adoption and live Worker/auth QA are not authorized by this update.

Testing

• 39 focused tests passed: runtime reads/fallbacks, subscriptions/readiness, real auth integration, stale-response races, exposure payloads, auth pinning, deduplication, and analytics opt-out.
• Those local tests used available Vitest 2.1.9 / Axios 1.13.6, not the repository's locked Vitest 4.1.9 / Axios 1.18.1. Scoped TypeScript 5.9.3 validation and git diff --check passed.
• Locked npm ci is blocked by local registry/security access; offline cache is incomplete. Full unit/type tests, build, lint, and generated documentation remain unverified locally and require CI or restored dependency access.
• Public types and JSDoc/pipeline registration included; no package or lockfile changes.