Stabilize bundled parser generation

Use exact-pinned esbuild so the committed bundle is reproducible across CI runners, generate and ship complete dependency licenses, keep the bundle under a size ceiling, and route degraded scans through the shared operational-failure exit handling.

AI assistance: Codex audited PR #693 and implemented this hardening.

cli/engine/engines/static-html/detect-html.mjs

@@ -133,7 +133,13 @@ async function detectHtml(filePath, options = {}) {
         'contrast are NOT evaluated; findings are an undercount, not a clean bill of health.\n',
       );
     }
-    globalThis.__impeccableStaticHtmlDegraded = true;
+    if (typeof options.onOperationalFailure === 'function') {
+      options.onOperationalFailure({
+        engine: 'static-html',
+        reason: 'parser-bundle-unavailable',
+        target: filePath,
+      });
+    }
     return detectText(html, filePath, options);
   }