v3.9.0

"Independence" (LOG #93): a game no longer has to live in this repository. The engine is a package, a game made from
its packed template outside the repository is verified, built and played to its end in CI, and an independent game,
"The Lighthouse", passes the commercial release gate on the packed engine.

Added

• The engine as a package (docs/en/PACKAGE.md): npm run pack makes web-scumm (the engine, its pages, its tools,
  the template, the web-scumm command) and create-web-scumm. npx create-web-scumm my-game makes a project with
  game/, public/, a package.json calling web-scumm dev|studio|assets|verify|build|release, and a tsconfig.json
  pointing into the package; the tools run on the project (WEB_SCUMM_PROJECT) and never write into the package.
  Releases attach both tarballs, attested and summed.
• npm run fresh-install, a CI job: packs, creates a game in an empty folder outside the repository, installs the
  tarball, runs assets, verify and build, and plays the game to its end in Chromium. A file of the project that
  names the repository fails it.
• The template has its own placeholder art, drawn from shapes (tools/placeholder-art.py): a new game no longer
  borrows the sample game's. web-scumm migrate [--check] brings a game to the current authoring schema (3), and
  web-scumm ids gives it its stable ids.
• The public API, as a preview of 4.0's contract (docs/en/API.md): web-scumm/content, web-scumm/player,
  web-scumm/minigames, web-scumm/testing (src/engine/api/, the package's exports). tests/api-surface.json
  holds their names and the Studio/MCP tools' arguments; tests/api-surface.test.ts fails on a change API.md does
  not document. The template imports from them only. docs/en/SUPPORT.md says what 4.0 will promise.

Fixed

• verify:commercial found the files a source names only under games/, tools/, src/, public/: a game in its
  own project (art-src/draw.py) failed it. Any relative path counts now, resolved in the project; a URL never does.

Deprecated

• RevealDef: use EndingDef; removed in 5.0.

Manual passes (D12: reported, not blocking)

0 of 7 done.

Pass	Status	Who, when	Device, OS, browser, versions	What failed
Screen reader (docs/dev/SCREEN-READER.md, VoiceOver iOS or TalkBack Android)	not done
Safari offline (docs/dev/SAFARI-OFFLINE.md: first visit online, airplane mode, a room never visited, a reload)	not done
Real phone, frame rate of the heaviest scene (≥ 30 FPS)	not done
Playtesters who do not know the puzzles (npm run verify:field: sessions, finished, device families)	not done
Recorded voices (lines approved / lines with an id)	not done
Listening (each score on a phone speaker and on headphones, each bridge, a save loaded mid-transition)	not done
Signed tag (git tag -s)	not done