Merge main: skipScan visual-contrast coverage, live overlay waivers, generated output sync

The generated browser bundle is rebuilt from the merged engine sources in the next commit's build step (both branches had regenerated it).

AI-assisted (Claude Code).

skill/scripts/lib/live-path-globs.mjs

@@ -0,0 +1,37 @@
+/**
+ * Convert a live-config glob pattern to a RegExp.
+ *
+ * Supports `**` across path segments, `*` within one segment, and `?` for one
+ * character. Callers normalize project-relative paths to forward slashes.
+ */
+export function livePathGlobToRegex(pattern) {
+  let re = '';
+  let i = 0;
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === '*') {
+      if (pattern[i + 1] === '*') {
+        if (pattern[i + 2] === '/') {
+          re += '(?:.*/)?';
+          i += 3;
+        } else {
+          re += '.*';
+          i += 2;
+        }
+      } else {
+        re += '[^/]*';
+        i += 1;
+      }
+    } else if (c === '?') {
+      re += '[^/]';
+      i += 1;
+    } else if (/[.+^${}()|[\]\\]/.test(c)) {
+      re += `\\${c}`;
+      i += 1;
+    } else {
+      re += c;
+      i += 1;
+    }
+  }
+  return new RegExp(`^${re}$`);
+}