Restores the xlsx read/write surface dropped in 1.2.6 (when exceljs
was removed for being unmaintained + carrying deprecated transitive
deps). SheetJS CE 0.20.3 is vendored at vendor/xlsx-0.20.3.tgz with
SHA-256 verification at both prepublish and unit-test time. End-user
install remains a single `npm i -g @cmetech/otto` — no CDN reach.

CE → Pro upgrade path: swap the vendored tarball + the file: dep
spec. No code change. Documented in vendor/README.md.