Fix vendored bundle ranking and add website changelog

[aryamthecodebreaker]

What changed

• treat one bundler fingerprint as sufficient when the file is already under a generated or compiled path
• keep readable vendored source rankable when it has no bundler fingerprint
• add a deterministic pretty-printed vendored-bundle adversarial case
• regenerate the checked-in GitHub Action bundle
• add a static website changelog with recent features, fixes, improvements, security notes, and evidence
• link the changelog from desktop/mobile navigation, the footer, and sitemap

Root cause

Pretty-printed dependency bundles could miss the 400-character line threshold and carry only one bundle marker. With no maintained source twin, they also bypassed the generated-duplicate guard and could rank first at high confidence.

Validation

• npm run ci
• workspace: 420 tests
• production web build: 12 static pages, including /changelog
• browser: 1440px and 390px, zero overflow, zero console errors or warnings
• adversarial: 9/9, false-confidence rate 0.0
• held-out: 7/12 Top-1, 8/12 Top-3, 9/12 Top-5 (unchanged)
• external: 11/16 Top-1, 16/16 Top-3, 16/16 Top-5 (unchanged)
• Chalk source/vendor/supports-color/index.js remains Top-1

No package version, tag, release, npm publication, or MCP publication is included.

Fixes #446