feat(csr): ship standalone worker file and expose workerUrl option

[nicklasl]

Summary

• Ship dist/confidence-worker.js as a standalone file customers can copy to their static assets
• Expose workerUrl on initSessionRecorder for customers whose CSP blocks data: and blob: in worker-src
• Re-export workerScript from @spotify-confidence/session-recording/worker for server-route integration
• Add CSP section to the README covering required directives, hosting options, and troubleshooting

Build restructure

The standalone worker file is now a first-class build artifact of csr-common. During csr-common's build, emit-worker-file.mjs extracts the bundled workerScript string from the compiled output and writes it as dist/confidence-worker.js. session-recording simply copies the file from csr-common's dist — no regex parsing, no second rolldown invocation.

Build order:

1. csr-common prebuild → build-worker.mjs bundles worker source into string constant + generates csr-version.ts
2. csr-common build → tsdown, then emit-worker-file.mjs writes dist/confidence-worker.js
3. session-recording build → tsdown, then copies from csr-common/dist/confidence-worker.js

Follow-up (separate PR)

• Version handshake: tab sends sdkVersion in hello, worker reports workerVersion in welcome, mismatch logs a warning via debugLogger
• ./worker helper export using new URL pattern for automatic bundler asset handling (needs Next.js validation)

Test plan

• yarn build:csr produces identical confidence-worker.js in both csr-common and session-recording dist
• Standalone file is valid JS (13.6KB)
• workerUrl forwarded from initSessionRecorder to createUploader (unit-tested)
• @spotify-confidence/session-recording/worker exports workerScript
• Full CSR test suite passes (136 tests)

🤖 Generated with Claude Code