- SpawnDev.SpawnJS 2.1.17 -> 3.0.0. Minor bump: a consumer pinning SpawnJS 2.x now gets NU1605.
- Restored the test suite lost in the BlazorJS -> SpawnJS move. PlaywrightTestRunner pointed at a
  SpawnDev.SpawnJS.Cryptography.Demo project that never existed here, so the library shipped
  2.0.0-2.0.2 with no runnable tests. Ported BlazorJS.Cryptography's WasmUnitTests to
  BrowserWasmDemo/Pages/WasmUnitTests.razor (SpawnDev.UnitTesting.Browser): 29 tests - key
  export/import, ECDH/ECDSA/Ed25519 sign/verify + rejection, AES-CBC/GCM, the issue #1 known-answer
  vectors, and 12 CrossPlatform_* tests against DotNetCrypto.
- The DotNetCrypto side is PlaywrightTestRunner/CryptographyTestApi.cs (minimal API on the runner's
  own HTTPS server, same origin as the app). The runner now publishes the demo itself (no stale
  publish), defaults to BrowserWasmDemo/tests, and fails on an empty test table.
- DotNetCrypto AES-GCM: obsolete Rfc2898DeriveBytes ctor (SYSLIB0060) -> Rfc2898DeriveBytes.Pbkdf2,
  same bytes. Red-checked: iterations+1 fails CrossPlatform_AESGCM_BrowserEncryptServerDecrypt.
- PortableECKey.NamedCurve base initialized (CS8618); every subclass overrides it. Library 0 warnings.

Tests: 29/29 Chromium, 29/29 Firefox.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>