refactor(sdk): consolidate visual paint heuristics

[leorivastech]

What

Consolidates the duplicated visual-paint color parsing used by the SDK, Studio, captions, and the CLI browser audit.

• Adds one pure CSS alpha parser in Core and exposes the host-facing API through the SDK.
• Makes Studio's visual-presence check delegate to SDK paint semantics while preserving Studio-specific box-shadow and audio policy.
• Reuses the shared transparency check when importing caption backgrounds.
• Injects the exact same alpha function into the CLI's standalone browser audit without leaking a global.

Fixes #3079.

Why

The existing copies already disagreed. In particular, Studio and captions only recognized a few transparent spellings, so a computed color such as rgba(255, 255, 255, 0) could be treated as painted. The CLI also maintained a separate alpha parser.

Keeping the pure parser in Core lets the SDK expose the shared host API while the CLI can bundle the function into its dependency-free browser payload. Caller-specific policy remains local.

How

• Adds cssColorAlpha and isTransparentColor under @hyperframes/core/visual-paint.
• Re-exports them from @hyperframes/sdk/visual-paint and uses the helper in the iframe adapter.
• Replaces Studio's background string matching with SDK delegation.
• Wraps layout-audit.browser.js at load time with a lexical, serialized cssColorAlpha; the source script remains an internal template and the delivered payload remains standalone.
• Documents the new SDK export.

Test plan

• Unit tests added/updated
• Manual testing performed — built the production CLI and executed the reconstructed browser payload in a VM; it was standalone and leaked no global
• Documentation updated

Verified:

• Core visual-paint tests: 7 passed
• SDK iframe tests: 97 passed
• Studio DOM editing and captions tests: 78 passed
• CLI loader and layout-audit tests: 85 passed
• Core, SDK, Studio, and CLI typechecks
• Studio and CLI production builds
• package-subpath validation, oxlint, oxfmt, and pre-commit hooks