docs: measured, minimized patches for vendored library upgrades

[Nawid3333]

Follow-up to #547, split out so nothing has to be read out of a fork. This PR is docs-only — it adds a vendor-upgrades/ directory and touches no code, so it's reviewable in any order and can be dropped without cost if you'd rather take a different approach.

What's in it

Measured, minimized patches that let FastStream upgrade its vendored libraries to current releases — plus the full analysis behind each one.

They were produced by diffing each vendored chrome/player/modules/* file against every published npm release, taking the smallest diff as the true base version, then re-deriving FastStream's own changes against the latest release and dropping every change that had already landed upstream.

The headline: hls.js upgrades to 1.7.2 with a 4-hunk / 62-line patch. The raw divergence from your vendored 1.6.9 copy was 22 hunks / 466 lines — most of it landed upstream between the two releases. The remaining four hunks are:

• the extra demuxer/remuxer exports (hls2mp4/transmuxer.mjs imports six classes stock hls.js doesn't export — "please export the demuxers" is also a small ask upstream, if you ever want the patch to shrink to ~3)
• outputSamples on the remux result (hls2mp4 needs the samples, not just the count)
• the subtitle part-loading guard (upstream issue #7460)

Also included

Patch	Against	What it carries
sweetalert2	11.26.25	keeps the locale-triggered payload block removed, the player-container rebinding, and replaces the dead new Function template-config path with a throw
mp4box	0.5.3	five changes; buildTrakSampleLists is the one MP4 playback actually depends on (found by bisect against a real playback suite)
jswebm	0.1.2	colour metadata, VP9 codec strings, and the keyframe→keyFrame fix (upstream writes one and reads the other, so every chunk was marked delta)
gif.js	0.2.0	worker URL from import.meta.url — the document-relative default 404s in an extension

And the part that might be the most useful: pako 3.0.1, fuse.js 7.5.0, sortablejs 1.15.7 and mp4-muxer 4.3.3 need no patch at all. The vendored copies are AST-identical to the published builds once eslint --fix output is normalized away — the stock release can simply be vendored.

What's deliberately not here

dash.js. A three-way comparison (stock 5.1.0 vs. your patched bundle vs. stock 5.2.1) found 0 of your 68 customized modules landed upstream in the 5.1.0→5.2.1 window, so there's no shortcut there. The module-by-module inventory is in the analysis doc — knowing exactly where the real work is seemed more useful than a patch that doesn't exist yet.

Verification

Every recipe was validated with an end-to-end playback suite that plays real HLS/DASH/MP4 streams in Firefox and asserts currentTime advances — a broken library swap is exactly the kind of thing that loads and then never decodes, which no unit test catches.

One more thing

I want to be straightforward about where I stand. Your LICENSE requires permission before using your code, so my fork stays a personal unlisted build for my own browser — nothing of yours has been distributed publicly by me, and none of this needs a merge from you to keep working. If you're ever comfortable with the fork existing as a public/unlisted distribution under your terms — or want anything about it changed or taken down — just say so here or privately, and either answer works. No pressure either way; the fixes are offered regardless.