Self-host the CodeMirror 5 demo runtime

[haoranyu]

Refs #53

Summary

• replace the v1 demo's cdnjs dependencies with exact CodeMirror 5.65.21 files from the locked npm package
• retain the upstream MIT license and verify every vendored byte plus reviewed SHA-256 hashes
• keep v1 test discovery isolated from generated CM6 browser fixtures when switching branches in one working tree

Verification

• npm test (24/24)
• npm audit --omit=dev (0 vulnerabilities)
• npm pack --dry-run --json
• git diff --check

The main Pages PR will pin the resulting v1 merge commit and run both demos with all external HTTP(S) assets blocked.