Rejuvenation: dev tooling, CI, security fix, README, tests

[botre]

What changed

Dev dependencies

• vitest and @vitest/coverage-v8 4.1.5 -> 4.1.10 (pulls vite 8.2.0, clearing the launch-editor and vite server.fs.deny advisories)
• jsdom 29.1.1 -> 30.0.1 (major: drops Node 20 support, adds CSS.escape/supports and computed-style unit resolution; dev-only, no impact on our DOM/forms tests)
• prettier 3.8.3 -> 3.9.6 (only normalizes a couple of trailing commas and a line wrap in src)
• typescript stays at 5.9.3 on purpose: TS 7.0 is the native (tsgo) compiler with no Compiler API, which breaks tsup's dts generation until the new API lands in 7.1, and 6.0 is still beta
• tsup stays at 8.5.1 (current)
• npm override pinning esbuild to ^0.28.1: tsup pins ^0.27.x, which sits in the vulnerable 0.27.3-0.28.0 range (GHSA-g7r4-m6w7-qqqr). The 0.28.1 changelog shows no output-format changes for our usage. npm audit is now clean (0 vulnerabilities).

CI

• actions/checkout v6 -> v7 (only restricts fork-PR checkout on pull_request_target/workflow_run, which we do not use)
• actions/setup-node v6 -> v7 (ESM migration, inputs unchanged)
• Check workflow now runs on Node 24.x, matching the Release workflow (also required since jsdom 30 needs Node >= 22.22.2)

README

• Fixed the comma splice in the About section, the "within your form element" phrasing, and the awkward table entries for ref/referrer/utm_source
• Added a short npm install/import section

Tests

• Added two edge cases: URL-encoded parameter values are decoded (+ and %26), and a non-input control sharing a parameter name is left alone while a hidden input is appended
• 18 tests, all passing; typecheck clean

Version

• 0.1.37 -> 0.1.38, not published (the Release workflow will bump and publish on merge as usual)

Backward-compat verification

• npm pack of this branch compared against the published @formspark/formtrack@0.1.37 tarball: identical file list, identical main/module/unpkg/types/files/engines/dependencies fields
• dist/index.js, index.mjs, index.d.ts, index.d.mts are byte-identical to the published files
• dist/index.global.js differs only by esbuild 0.28.1's CommonJS helper (try/catch around lazy module init) and minifier identifier renames; global name Formtrack and the Object.assign(Formtrack.default, Formtrack) UMD surface are unchanged
• Loaded both the published and the new IIFE bundle via a real script tag in jsdom against a page with UTM query params, a pre-existing hidden field, and a custom param: injected values, input counts, stale-field update, typeof Formtrack, Formtrack.default, and idempotent re-registration are identical between the two

Risks

• The esbuild override applies only to this repo's own install (npm overrides do not propagate to consumers), but it does diverge from tsup's tested esbuild range; the IIFE bundle was behavior-verified above
• The Release workflow bumps the version again on merge, so the published version will be 0.1.39; harmless but worth knowing
• jsdom 30 means contributors need Node >= 22.22.2 locally to run tests; the published engines field (>=20) is deliberately untouched since it is the consumer contract