0.11.2: the comma operator, and the tag the docs hand out

Fixed

• The comma operator works inside parentheses. (a, b) evaluates both and
  yields the last, and it did not parse. The top level already accepted ,
  between statements, so @click="a++, b++" worked while
  @click="ok && (a++, b++)" failed with Expected ")" but found ",", a
  distinction nobody would predict.

  It surfaced through this project's own playground: the todo example could not
  add an item, because draft && (items.push({ text: draft }), draft = '') is
  how you write "do these two things only if", and that is exactly the shape
  that did not parse. The example had shipped using syntax the parser rejected.

  Verified in a browser, the whole todo: adding clears the field and updates the
  count, the three filters select the right items, and the checkbox toggles with
  the count following.

  Expressions the interpreter answers differently from JavaScript: still 0.
  Valid JavaScript it refuses: 3 down to 2, and both remaining are regex
  literals.

Changed

The rest of this release is what the documentation tells people to load, which
had been wrong in three separate ways at once.

• Every CDN tag names the full build. Twenty-one of them named
  voodoo.min.js, the essential build, which does not contain JSX. So the
  installation page handed out a tag, the JSX page handed out an example, and
  putting the two together produced a page printing its own source back with
  nothing to explain why. The size cost is stated rather than hidden: the full
  build is 132 KB gzipped against 84, and dropping .full is one edit.

• The version is pinned exactly, not to the minor line. voodoojs@0.11 is
  the same string for 0.11.0, 0.11.1 and everything after, so a reader could not
  tell whether a fix had landed. Worse, jsDelivr caches a range at the edge for
  twelve hours: 0.10.1 fixed the playground and the playground went on serving
  0.10.0 until the cache was purged by hand, and 0.11.1 did it again. An exact
  version is a different URL that no stale range can shadow, and it is live the
  moment npm has it.

• The stamp finds files instead of being told about them. It worked from a
  hand-written list of four, and a hand-written list is always missing
  something. What it was missing, ten releases in: SECURITY.md and four pages
  under docs/ still said voodoojs@0.1.0, and scripts/components-page.mjs,
  which generates site/components.html, was frozen at 0.5 and regenerated
  that page wrong every time it ran. It asks git for the tracked files now.
  CHANGELOG.md stays excluded, because rewriting the versions in old entries
  would turn a record of what happened into a claim that never was.

• Three paragraphs that described the old pinning were left saying 0.4, 0.4
  and 0.6, which stopped being merely stale and became false once the pin
  changed.

Full notes: v0.11.2

---

Read more in the CHANGELOG, or browse the documentation and the playground.