v0.3.0 — two carriers, external pages, scheme-less URLs

[0.3.0] — 2026-11-06

Added

• Address-bar normalisation: example.com opens https://example.com/;
  local/dev hosts (localhost, *.local, private, loopback and link-local
  addresses) use http://; non-web schemes are refused. The same rule is
  enforced on the host /navigate route and covered by test/url-smoke.mjs,
  which also checks the mirrored copy in the client bundle.
• Public pages are documented as a first-class carrier: any site renders in the
  host Chromium over CDP, including sites that send X-Frame-Options/CSP.
• Four storefront screenshots in assets/screenshots/ and screenshots.json.
  They are mockups with invented data (Northwind Supply on example.com), not
  captures of a real session, and are reproducible via npm run mockups.
• Documentation and repository infrastructure: screenshot gallery, updated
  architecture diagram, CONTRIBUTING.md, SECURITY.md, issue/PR templates,
  GitHub Actions CI and Dependabot.
• Market entry draft for awesome-dsh-plugin (market/entry.yml).

Changed

• README architecture, usage, configuration table and known limitations now
  describe both carriers and the automatic scheme.
• package.json version, exports (./url), package file list and scripts
  (test, test:url, mockups).
• Preview harness renders through the client's real EN dictionary instead of
  raw source strings, and the mock page is a fictional English storefront.
• Screenshots generated with a 1600×1000 CSS viewport at 2× (3200×2000 PNG).

Fixed

• Native carrier address bar rejected scheme-less input while the proxy panel
  handled it; both now canonicalise through one rule.
• The preview server no longer leaks a device preset between screenshots.