v2.0.0-rc.30

Ship runtime sidecar subtitle injection (addSubtitleTrack/removeSubtitleTrack, SidecarSubtitleInput) that the video player's committed source depends on. CI: drop the forced npm@latest global upgrade that broke provenance publishing.