[Air #1388] feat: Vendor sdpi-components v4.0.1 into the plugin bundle

[amrmelsayed]

Summary

Vendors the sdpi-components library (v4.0.1 release build) into the Stream Deck plugin bundle and switches all three property-inspector pages from the remote CDN <script> to the local relative reference, so action configuration works offline and no remotely mutable code executes in the configuration UI.

Closes#1388

What Changed

• Added com.cluesmith.codev.sdPlugin/ui/lib/sdpi-components.js (v4.0.1, downloaded from https://sdpi-components.dev/releases/v4/sdpi-components.js; a second independent download produced an identical sha256 f6c0dfd2ed68e18084b9952842b86e3850cf837d674704700c2a0718e0a24f6b).
• codev-action.html, builder-action.html, fleet-slot.html now load <script src="lib/sdpi-components.js"> instead of the CDN URL.
• README gained a "Vendored dependencies" section noting the version, upstream source, and bump procedure (per the issue, so future bumps are deliberate).
• New guard test src/__tests__/vendored-ui-lib.test.ts: the vendored file exists in the bundle, every ui/*.html references the relative path, no src/href in any PI page points at a remote origin, and the README's documented version matches the vendored file's license header.

Key Decisions

• Vendored at ui/lib/sdpi-components.js, the location suggested in the issue and consistent with Elgato's bundling guidance.
• Kept the file byte-identical to the upstream v4 release build (no re-minification or patching), so runtime behavior is unchanged from what the CDN served.
• Skipped CMAP: dependency-vendoring change with no plugin logic touched.

Test Plan

• Unit tests added (vendored-ui-lib.test.ts — 8 new assertions across the three PI pages)
• Build passes (pnpm --filter @cluesmith/codev-streamdeck build)
• All tests pass (vitest: 5 files, 63 tests)
• streamdeck validate passes; streamdeck pack artifact includes ui/lib/sdpi-components.js (verified via unzip -l)
• Offline render check: each PI page loaded headless via file:// with all http(s) requests aborted — sdpi-select custom element registers, connectElgatoStreamDeckSocket entrypoint is defined, all options render, zero remote requests attempted

Settings persistence rides the live Stream Deck websocket, so that final leg stays a hardware smoke test; since the vendored file is byte-identical to what the CDN served, persistence behavior is unchanged.

Review Notes

The vendored file is third-party minified code — review its provenance (checksum above) rather than its contents. Everything else is three one-line HTML edits, a README section, and a guard test.

[amrmelsayed]

Integration review (streamdeck architect), low-risk tier, read in full + independently verified.

• Authenticity: vendored ui/lib/sdpi-components.js is byte-identical to the official https://sdpi-components.dev/releases/v4/sdpi-components.js (SHA-256 f6c0dfd2… matches a fresh download I made independently).
• All three property inspectors reference the relative lib/ path; the new vendored-ui-lib.test.ts is a proper regression guard — it bans ANY remote src/href in PI pages and cross-checks the README's documented version against the file's own license header. Nice touch.
• README documents v4.0.1 + the update procedure (re-download, replace, update version).
• Reproduced: 63/63 tests (5 files), pack builds, and the vendored file ships inside the artifact (55.8 kB at ui/lib/).
• This satisfies Elgato's distribution guidance verbatim ("When distributing your plugin, you should always reference the UI library locally" — docs.elgato.com/streamdeck/sdk/guides/ui).

No findings. Recommending approval at the pr gate; merge authorization is Amr's.