feat: browser experiments with auth-safe exposure tracking

[LiorMazig]

Summary

Adds base44.experiments for browser feature-flag reads, auth-aware readiness/subscriptions, and experiment exposure tracking. Draft pending platform integration and complete validation; no stable package release or dependency changes.

Intent (for reviewers & PR Autofix)

What this PR does

Adds SDK-owned experiment evaluation for browsers and request-scoped Workers, common-auth reactivity, hydration snapshots and acknowledged exposure delivery.

Key decisions & why

• Public bootstrap/request context supplies configuration; no per-decision fetch or experiment-specific auth lookup. Snapshot observation never records exposure.
• Legacy browser evaluation requires the client's app ID to match the companion bootstrap, on both activation and auth updates. Missing or foreign ownership returns fallbacks without experiment exposures.
• Preview intent is captured on goals at track-time; server Analytics state is per-client. Ordinary Analytics remains best-effort.
• Stable exposure ID, timestamp and credential survive bounded, memory-only retries.

What NOT to touch

The gateway-check workflow is intentionally unchanged from the PR base. Its unrelated action-pinning fix was removed at the author's request; handle any recurrence of that workflow's pre-existing startup failure separately, not by reintroducing it here.

No version, dependency or lockfile changes. Context headers are not authentication: ingress must strip/rebuild them. Public SDK API availability is not experiment enrollment. The Builder rollout flag is not a runtime kill switch. This fix intentionally leaves the existing Analytics visitor-only observer unchanged.

Tradeoffs / follow-ups

Isolation fix 55202d3 adds permanent regressions for foreign/unidentified runtimes and auth updates. Supplemental local verification: 105 focused tests and scoped TypeScript passed, using existing non-lock-exact dependencies. Locked CI on SDK implementation head 55202d3 passed 382 tests, type checks, lint and dependency audit; the preview package also built and published successfully. Shared Analytics changes still affect SDK upgraders without experiments and need release sign-off. Stable publication, production adoption and live Worker/auth QA are not authorized by this update.

Testing

• 39 focused tests passed: runtime reads/fallbacks, subscriptions/readiness, real auth integration, stale-response races, exposure payloads, auth pinning, deduplication, and analytics opt-out.
• Those local tests used available Vitest 2.1.9 / Axios 1.13.6, not the repository's locked Vitest 4.1.9 / Axios 1.18.1. Scoped TypeScript 5.9.3 validation and git diff --check passed.
• Locked npm ci is blocked by local registry/security access; offline cache is incomplete. Full unit/type tests, build, lint, and generated documentation remain unverified locally and require CI or restored dependency access.
• Public types and JSDoc/pipeline registration included; no package or lockfile changes.

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.49-pr.280.04af9f9

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.49-pr.280.04af9f9"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.49-pr.280.04af9f9"
  }
}

• 📦 Preview Package: @base44-preview/sdk@0.8.49-pr.280.04af9f9
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}

[LiorMazig]

Current-head verification update (supersedes the earlier figures):

• SDK f9498cf: 365 locked tests, type tests, lint, dependency audit and preview publishing passed. Documentation automation passed on its one-time timeout retry.
• Published preview npm:@base44-preview/sdk@0.8.48-pr.280.dac0f98 is pinned and adopted by the disposable classic app. Real preview-goal exclusion and normal-goal attribution passed, matching the Builder dashboard.
• The separate pre-existing Wix Gateway workflow startup failure remains; required human review is still pending.
• Stable @base44/sdk was not published. Real full-stack/Worker auth, production-scale access/load evidence and delayed live finalization remain rollout gates. No dependencies or lockfiles changed.

[arosenan]

Two actionable findings from the cross-PR experiments review, rechecked against the current SDK head. The existing identity-lookup P1 on apper #23909 remains tracked in its original thread.