[cguodesign]

Consumer verification passed all five fixtures but CI remained alive until its 30-minute timeout: shutting down the npm launcher left Vite descendants holding its pipes open. Start each installed Vite CLI directly with Node, await closure, and force-stop an unresponsive preview after five seconds.

The eight expected invalid TypeScript cases remain checked for both React versions. Successful negative checks now print their summary only, avoiding false GitHub error annotations; unexpected diagnostics still fail with full output.

Make the vertical wrapped-target stress conditions explicit, retain the multi-rectangle, mark attachment, fallback and semantic assertions, and include computed layout details on failure. Install the configured Noto CJK font family on the Linux runner for these fixtures.

Also records the published proofmarks@0.1.0 date in CHANGELOG, removes the unpublished README notice, and documents the enabled private vulnerability-reporting channel. The published npm package and library runtime are unchanged.

Validation:

• All five packed consumers passed typechecks, SSR, builds and browser checks with zero runtime errors; the harness exited normally and all preview ports closed.
• Both React fixtures verified all eight expected type errors.
• The packed archive remains byte-for-byte identical to published 0.1.0.
• All 34 tests in the affected browser suites passed locally.
• Complete Linux verify:release passed: 177 unit tests, 158 browser tests, 11 built-site tests, all five consumers, builds, typechecks, audits, and git diff --check. No failure annotations; Pages deployment remains gated. Run: https://github.com/cguodesign/proofmarks/actions/runs/40577759347 .