feat: add v1.12 server trace runtime and worker detection

[JimmyDaddy]

Summary

• add a DOM-free invisible-watermark runtime behind the explicit react-native-image-marker/trace-runtime.js subpath, with injected RGBA codecs and ordered batch helpers
• add a Node.js 22 + Sharp Trace Service example with bounded HTTP inputs, server-owned keys, injectable storage/Content Credentials, Docker packaging, and a repeatable reliability benchmark
• move opt-in Web detection to a one-shot dedicated Worker with transferable pixels, progress, cancellation, strict protocol validation, and no silent fallback
• expose the Worker controls in the bilingual playground and document the runtime, deployment, and security boundaries
• add Node 22/24, Sharp, container, tarball-boundary, and Chromium/Firefox/WebKit CI coverage

On-demand packaging

The normal React Native entry only type-exports the server contracts. It does not runtime-import trace-runtime; consumers explicitly import react-native-image-marker/trace-runtime.js. The npm tarball includes the subpath and standalone Worker, while excluding the Trace Service and Sharp.

Verification

• npm run typecheck
• npm run lint
• npm test -- --runInBand — 116 tests
• npm run test:web -- --coverage — Web 88.02% lines, Worker client 89.7% lines
• Trace Service TypeScript check and 8 Node/Sharp integration tests
• reliability benchmark: PNG, JPEG 90/75, four resize candidates, JPEG 75 + resize, crop, wrong-key, and unmarked cases recorded
• npm run docs — 168 pages, links, sitemap, and custom domain verified
• production audits for root and Trace Service — 0 vulnerabilities
• npm tarball installed into an empty consumer and verified through CommonJS, Node ESM, and TypeScript

The local Docker daemon was unavailable, so the Dockerfile build is enforced in the Node 22 CI job.