docs: link the live demo, and generate the social card - #12

The demo URL appeared nowhere in the repository — including the npm README,
which is the page a stranger lands on. It is now in the npm README, the root
README, llms.txt and the workspace table.

The social card was drawn by hand and still said 8.6 KB after the published
figure was corrected. scripts/make-og.mjs renders it from HTML in Chromium, so
the card and the text come from the same source and cannot drift apart.

A devDependency was added to package.json without the lock file being
regenerated alongside it. `npm ci` refuses to install when the two
disagree, so every job died at the install step before a single test
ran — and the error talked about the lock file rather than about the
dependency that caused it.

scripts/verify-lockfile.mjs compares the two files and names the
offending package and the command that fixes it. It has no dependencies
and makes no network calls, so CI runs it *before* `npm ci` and the
failure now arrives with its own name on it.

.githooks/pre-commit runs Prettier over the staged files and that lock
file check, in about a second. .githooks/pre-push adds the unit tests,
the library build and the zero-dependency check, in about thirty.
Server rendering, prerendering, the documentation examples, native CSS
masonry and the Angular version matrix stay in CI: they need a browser
or several full builds, and a four-minute hook is a hook people bypass.

The hooks install through `prepare`, which sets core.hooksPath. That is
the whole of what husky does, so the repository keeps no dependency for
it. The `|| true` keeps `npm ci` working where there is no .git, as on
Vercel.