feat(editor-v2): build script + first bundle output

build-editor.sh runs npm install + esbuild from editor-src/, produces:
- editor.bundle.js  324.6 KB minified IIFE, sets window.__editor.mount
- editor.bundle.css 0 B placeholder (cm6 injects styles at runtime
  via StyleModule; future extensions that need real CSS can drop into
  the same file without a template change)
- editor.bundle.sha256 integrity hashes

The script uses $TMPDIR/npm-cache (override via NPM_CACHE env var)
to work around root-owned files in the default ~/.npm cache from
older npm versions (the env's `npm ci` rejected the default cache).

vendor/README.md documents the rebuild command, the cache override,
and the integrity-record convention.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

l4d2web/l4d2web/static/vendor/README.md

@@ -0,0 +1,32 @@
+# Editor bundle vendor README
+
+`editor.bundle.js` is a pre-built IIFE produced by esbuild from
+`l4d2web/scripts/editor-src/`. It exposes `window.__editor.mount(textarea, opts)`.
+
+## Rebuild
+
+From repo root:
+
+```
+./l4d2web/scripts/build-editor.sh
+```
+
+This runs `npm install` inside `editor-src/` then `npx esbuild`. The
+output overwrites `editor.bundle.js` and `editor.bundle.css` in this
+directory and refreshes `editor.bundle.sha256`.
+
+The build script uses `$TMPDIR/npm-cache` (override with the
+`NPM_CACHE` env var) as the npm cache to avoid permission issues with
+root-owned files in `~/.npm/_cacache/` from older npm versions.
+
+## Pinned dependencies
+
+See `l4d2web/scripts/editor-src/package.json` for semver ranges and
+`package-lock.json` for the exact resolved versions. Run
+`npm outdated` inside `editor-src/` to see upgrade candidates.
+
+## Integrity
+
+`editor.bundle.sha256` contains the hashes of the committed bundle.
+If the bundle drifts from this hash in CI / review, the artifact was
+rebuilt without committing the updated bundle.

l4d2web/l4d2web/static/vendor/editor.bundle.sha256

@@ -0,0 +1,2 @@
+a2cab604c51a916119ec71f15f948c3304bf54c39bbb7b36e5515891c7849484  editor.bundle.js
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  editor.bundle.css

l4d2web/scripts/build-editor.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SRC="$HERE/editor-src"
+OUT="$HERE/../l4d2web/static/vendor"
+
+cd "$SRC"
+
+# Honor an existing $NPM_CACHE override; fall back to $TMPDIR if the
+# default ~/.npm cache is unwritable (root-owned files from older npm
+# versions are a common cause; see ~/.npm/_logs).
+NPM_CACHE="${NPM_CACHE:-$TMPDIR/npm-cache}"
+npm install --cache "$NPM_CACHE"
+
+npx esbuild editor-entry.js \
+  --bundle --minify \
+  --format=iife \
+  --global-name=__editor_pkg \
+  --outfile="$OUT/editor.bundle.js" \
+  --metafile=meta.json \
+  --loader:.css=text
+
+# cm6 injects its styles at runtime via the StyleModule machinery, so the
+# bundle does not produce a separate .css file. We create an empty
+# editor.bundle.css so the partial template's <link> tag points at
+# something concrete (and future extensions that produce real CSS can
+# drop it in without a template change).
+: > "$OUT/editor.bundle.css"
+
+(cd "$OUT" && shasum -a 256 editor.bundle.js editor.bundle.css > editor.bundle.sha256)
+
+echo "Built $OUT/editor.bundle.js ($(wc -c < "$OUT/editor.bundle.js") bytes)"