feat(embed): versioned loader with postMessage whitelist

packages/embed-loader：手写零依赖加载器（esbuild bundle+minify→dist/v1/loader.js，
IIFE target es2018 4.7KB）。自发现 EMBED_ORIGIN（currentScript 兜底扫描）、
data-slot 必填缺失静默 no-op、__photoliveEmbedV1 标记去重+同槽去重、
窄屏 <480px 强制 sm+默认收起、postMessage 双向白名单（source+origin 严格
校验，resize 夹取 60-640）、sessionStorage 收起记忆、零全局零 console
全静默。sync 脚本携 sha256 校验拷贝至 viewer publicDir（两份产物入库）；
src/params.js 为 loader/单测共用参数源（11 vitest 用例）。

Co-Authored-By: Claude Code <noreply@anthropic.com>

pnpm-lock.yaml

@@ -280,6 +280,15 @@ importers:
         specifier: ^5.6.0
         version: 5.6.3
 
+  packages/embed-loader:
+    devDependencies:
+      esbuild:
+        specifier: ^0.21.5
+        version: 0.21.5
+      vitest:
+        specifier: ^2.1.0
+        version: 2.1.9(@types/node@24.13.5)(jsdom@25.0.1)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2)
+
   packages/storage:
     dependencies:
       '@aws-sdk/client-s3':
@@ -8058,6 +8067,14 @@ snapshots:
     optionalDependencies:
       vite: 5.4.21(@types/node@22.20.3)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2)
 
+  '@vitest/mocker@2.1.9(vite@5.4.21(@types/node@24.13.5)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2))':
+    dependencies:
+      '@vitest/spy': 2.1.9
+      estree-walker: 3.0.3
+      magic-string: 0.30.21
+    optionalDependencies:
+      vite: 5.4.21(@types/node@24.13.5)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2)
+
   '@vitest/mocker@4.1.11(vite@7.3.6(@types/node@24.13.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2))':
     dependencies:
       '@vitest/spy': 4.1.11
@@ -11734,6 +11751,24 @@ snapshots:
       - supports-color
       - terser
 
+  vite-node@2.1.9(@types/node@24.13.5)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2):
+    dependencies:
+      cac: 6.7.14
+      debug: 4.4.3(supports-color@10.2.2)
+      es-module-lexer: 1.7.0
+      pathe: 1.1.2
+      vite: 5.4.21(@types/node@24.13.5)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2)
+    transitivePeerDependencies:
+      - '@types/node'
+      - less
+      - lightningcss
+      - sass
+      - sass-embedded
+      - stylus
+      - sugarss
+      - supports-color
+      - terser
+
   vite-plugin-compression@0.5.1(vite@7.3.6(@types/node@24.13.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2)):
     dependencies:
       chalk: 4.1.2
@@ -11802,6 +11837,18 @@ snapshots:
       sass: 1.104.1
       terser: 5.51.2
 
+  vite@5.4.21(@types/node@24.13.5)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2):
+    dependencies:
+      esbuild: 0.21.5
+      postcss: 8.5.28
+      rollup: 4.63.3
+    optionalDependencies:
+      '@types/node': 24.13.5
+      fsevents: 2.3.3
+      lightningcss: 1.32.0
+      sass: 1.104.1
+      terser: 5.51.2
+
   vite@7.3.6(@types/node@24.13.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2):
     dependencies:
       esbuild: 0.28.2
@@ -11854,6 +11901,42 @@ snapshots:
       - supports-color
       - terser
 
+  vitest@2.1.9(@types/node@24.13.5)(jsdom@25.0.1)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2):
+    dependencies:
+      '@vitest/expect': 2.1.9
+      '@vitest/mocker': 2.1.9(vite@5.4.21(@types/node@24.13.5)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2))
+      '@vitest/pretty-format': 2.1.9
+      '@vitest/runner': 2.1.9
+      '@vitest/snapshot': 2.1.9
+      '@vitest/spy': 2.1.9
+      '@vitest/utils': 2.1.9
+      chai: 5.3.3
+      debug: 4.4.3(supports-color@10.2.2)
+      expect-type: 1.4.0
+      magic-string: 0.30.21
+      pathe: 1.1.2
+      std-env: 3.10.0
+      tinybench: 2.9.0
+      tinyexec: 0.3.2
+      tinypool: 1.1.1
+      tinyrainbow: 1.2.0
+      vite: 5.4.21(@types/node@24.13.5)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2)
+      vite-node: 2.1.9(@types/node@24.13.5)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2)
+      why-is-node-running: 2.3.0
+    optionalDependencies:
+      '@types/node': 24.13.5
+      jsdom: 25.0.1
+    transitivePeerDependencies:
+      - less
+      - lightningcss
+      - msw
+      - sass
+      - sass-embedded
+      - stylus
+      - sugarss
+      - supports-color
+      - terser
+
   vitest@4.1.11(@opentelemetry/api@1.9.0)(@types/node@24.13.5)(jsdom@25.0.1)(vite@7.3.6(@types/node@24.13.5)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.104.1)(terser@5.51.2)):
     dependencies:
       '@vitest/expect': 4.1.11