Release v4.37.0

Part 4 and last of the foundation composites (Part B 4), and the browser audit becomes a CI gate.

Added

• approvalChainStepper: the steps a request goes through, who decides each and where it stands. The chain applies its own rules, so a request page needs none: a rejection stops the chain and the steps after it read "Not reached"; with no step marked current the first undecided step is the current one; only one step is current. The overall outcome is stated, every step says its state in words as well as by icon and color, the current step carries aria-current="step", and the list reads vertically on a phone.
• orgTree: an organization as an expandable tree built from flat rows (id, label, title, parentId) as a query returns them - someone whose manager is missing becomes a root and a reporting cycle is cut instead of looping. It follows the ARIA tree pattern with one tab stop and the full keyboard set, says how many reports each person has in words, and publishes the selected id as value.
• permissionMatrix: roles across, permissions down (optionally grouped), a checkbox where they meet, named "Grant permission to role"; every header is a real header cell. Grants of a role or permission that does not exist are ignored; changes are published as value. Without the edit permission each cell says "Allowed" or "Not allowed" in words and by icon. Wide matrices scroll in a keyboard-focusable region with the permission column kept in view.
• Descriptors, categories, stories (every state, light and dark, a rejected chain, a read-only matrix), docs, and specifications for the chain rules, the tree building and the grant handling.
• CI: the JavaScript build now installs Chromium and runs yarn workspace @cratis/scene.blueprint.default test:browser, which audits every foundation component in every state at desktop, tablet and phone widths in the light and dark themes with colour contrast and page overflow (Part B 6), so a regression fails the build.

Part of #105