[callumalpass]

Summary

• Replace all 13 vendored i18n/UI dependency references across seven manifests with exact npm 0.1.0-beta.147, updating the pnpm lockfile.
• Remove obsolete multilingual i18n/UI tarballs and vendor-only metadata; update dependency documentation.
• Preserve publisher byte checks with an independent offline UI member fixture generated from the integrity-verified npm archive. Historical native approval fixtures still use their original approved archives in disposable data only; protected hashes and native publisher guard are unchanged.

Archive comparison / fixtures

Verified both exact versions with npm view and npm pack. Published UI and the previous 24e9f5d0 UI each contain 94 members: only package.json differs (version and development i18n pin). Published kit and vendored kit each contain 37 members: only the package version differs. Runtime code and catalogues are byte-identical; no application API changes or catalogue regeneration needed. All five UI consumer installations are checked against independent member hashes, and fixture integrity is bound to the npm lockfile.

npm installation does not imply native publisher/release qualification. The existing native guard continues to reject a registry dependency where it requires an independently approved file intake. No checks or protected approval pins were relaxed.

Verification (rpnpm)

• check: lint, formatting, architecture, typecheck, full tests, strict 10-locale i18n/composition/compilation/source gates — PASS.
• 3,324 Vitest workspace tests + 278 Node tests (181 publisher, 11 architecture, 54 reader scripts, 32 Zotero) — PASS, including existing literal-backslash/double-encoding regressions.
• i18n:source: PASS (589 modules).
• build and build:production: PASS across all workspaces.

No publication, release or deployment dispatch. Merge after green PR CI is authorized; the existing main workflow may deploy lab automatically.