0.28.1 — vendor @joan/procedural-glyph-engine for portable SPA builds (fixes deploy)

The procedural-glyph-engine dep pointed at a non-portable file:/private/tmp/orby-pkg
path, breaking npm ci in Docker and every main deploy since v0.20.0 (the build
cache masked it until it busted ~Aug 5). Vendor Orby v5.0.0 into web/vendor/,
switch the dep to file:../vendor, and use npm install in the web Dockerfile
(file: deps need install, not ci). Cherry-picked from 3cd4cf9.

web/vendor/manifest.json

@@ -0,0 +1,11 @@
+{
+  "name": "@joan/procedural-glyph-engine",
+  "version": "5.0.0",
+  "license": "SEE LICENSE IN LICENSE",
+  "entry": "./src/joan-engine.js",
+  "demo": "./index.html",
+  "assets": [
+    "./src/styles.css"
+  ],
+  "format": "esm"
+}