Refresh Current state for v0.1.0:82; document render-smoke build gate

Record the v82 vendor+SRI + render-smoke work in durable docs: packaging guide
gains the verified-build gate + re-vendor instructions; Current state rewritten
and compressed for v82; ROADMAP logs the deferred pre-compile-JSX alternative.

docs/guides/packaging.md

@@ -21,6 +21,18 @@ Start9 0.4.x ignores a same-version rebuild (the install silently does nothing).
 cd start9/0.4 && make        # -> ten-database_x86_64.s9pk
 ```
 
+- The default `make` goal is `verified-build`: it runs the **frontend render smoke check**
+  (`start9/0.4/render-smoke.mjs`, via jsdom) *before* packing, so a build that can't render
+  fails fast. Run it standalone with `make render-smoke` (or `node render-smoke.mjs`). It
+  (1) transforms the app's inline JSX with the **shipped** Babel and asserts a classic,
+  non-module, parseable script — catching the v79 Babel-8 ESM-import regression — and
+  (2) mounts the app in jsdom and asserts the login UI renders — catching the v78 blank
+  screen. `jsdom` is a build-time devDependency (not shipped in the image); `npm ci` pulls
+  it. **Front-end libs are vendored + SRI-pinned** in `frontend/assets/vendor/` (React,
+  ReactDOM, Babel) and served same-origin — never re-point them at a CDN. If you re-vendor,
+  regenerate each `integrity="sha384-…"` in `frontend/index.html` with
+  `openssl dgst -sha384 -binary FILE | openssl base64 -A`.
+
 ## Install — PRODUCTION
 
 ```bash