0.28.1 — vendor @joan/procedural-glyph-engine for portable SPA builds (fixes deploy)

The procedural-glyph-engine dep pointed at a non-portable file:/private/tmp/orby-pkg
path, breaking npm ci in Docker and every main deploy since v0.20.0 (the build
cache masked it until it busted ~Aug 5). Vendor Orby v5.0.0 into web/vendor/,
switch the dep to file:../vendor, and use npm install in the web Dockerfile
(file: deps need install, not ci). Cherry-picked from 3cd4cf9.

web/vendor/examples/README.md

@@ -0,0 +1,18 @@
+# Orby runnable examples
+
+Serve the extracted download folder over HTTP, then open one of these files:
+
+- `canvas.html` mounts the native canvas engine and invokes semantic states.
+- `web-component.html` uses the browser-native `<joan-glyph>` element.
+- `state-sequence.html` runs, pauses, resumes, and restarts a timed sequence.
+
+For example:
+
+```sh
+python3 -m http.server 4173
+```
+
+Then visit `http://127.0.0.1:4173/examples/canvas.html`.
+
+Every import is relative to the files included in the kit. No package registry,
+bundler, framework, or third-party dependency is required.