v4.2.1

Patch release fixing a plugin-mode-only regression in the frontend contact form. Drop in via `composer update tallcms/cms`.

Fixed

Contact form broken on plugin-mode frontends (#68)

Plugin-mode installs running v4.0.x – v4.2.0 had a broken contact form on the frontend. Browser console logged:

```
Alpine Expression Error: contactForm is not defined
Alpine Expression Error: formError is not defined
```

Two compounding causes:

1. `@tallcmsCoreJs` resolved to nothing. The Blade directive looked up `resources/js/tallcms-core.js` in the host's Vite manifest. That entry only exists in the standalone scaffold's `vite.config.js`; plugin-mode hosts don't have it. The directive emitted an empty string, and Alpine never registered the `contactForm` / `commentForm` components.

2. The package-shipped fallback was stale. `packages/tallcms/cms/resources/dist/tallcms.js` had drifted from the source under `resources/js/tallcms/components/`. It missed an `errors:{}` state (so field templates reading `errors.` threw), submitted `_page_url` instead of `_pageUrl` (so submissions rejected with 'Invalid form configuration'), and didn't register `commentForm` at all.

Both fixed:

• `ThemeManager::getCoreJsTag()` gains a third resolution tier — after dev-hot-file and Vite-manifest checks, it falls back to `public/vendor/tallcms/tallcms.js` (already published by `vendor:publish --tag=tallcms-assets`).
• The package-shipped `tallcms.js` is rebuilt from the current source. Now contains `Alpine.data('contactForm', ...)`, `Alpine.data('commentForm', ...)`, an `errors:{}` state, and submits `_pageUrl`.

New contract test

`CoreJsRuntimeContractTest` pins the minimum runtime contract: both Alpine components register, errors state initialises, `_pageUrl` is the submission key, and the bundle stays above a sanity-check minimum size. Catches future drift between source and shipped bundle at CI time instead of in production.

Standalone behaviour

Unchanged. The manifest check still fires first whenever the host's Vite build includes the entry. Dev hot-reload still takes absolute precedence.

Upgrading

`composer update tallcms/cms` then redeploy. No manual steps. After the deploy completes, hit any frontend page with a contact-form or comments block — the form should now render and the Alpine console errors are gone.

If you still see the errors after upgrading, confirm `vendor:publish --tag=tallcms-assets --force` is part of your deploy script (the published `public/vendor/tallcms/tallcms.js` is what the new fallback resolves to).

Out of scope (deferred)

• Package-owned JS build pipeline — tracked in #69. The current bundle rebuild is manual; the proper fix gives the package its own `build:js` script (esbuild) so source-to-bundle drift can't happen again. The contract test from this release acts as a safety net until then.