Covered source acquisition and library build materials

Use the source archives already supplied under source/, with hashes recorded
in source-provenance.json and SHA256SUMS.txt. Alternatively use the pinned public
URLs in NOTICES.txt. Do not use a moving branch or newly resolved version instead.

ExtPay3.1.2 commit: 5e648eaf53d9b82231e239e50310debc100247d1
Its original dist/ExtPay.js matches the bundled file identified in NOTICES.txt.
Preferred source is ExtPay.dev.js, importing webextension-polyfill. The complete
snapshot supplies package.json, package-lock.json (v3), types.d.ts and release
Rollup configuration. Direct locked versions are:
webextension-polyfill 0.7.0; @rollup/plugin-commonjs 17.1.0;
@rollup/plugin-node-resolve 11.2.1; @rollup/plugin-replace 2.4.2;
rollup 2.79.1; rollup-plugin-terser 7.0.2.
All 70 locked package resolutions, integrity values and download URLs are in
ExtPay-3.1.2-dependencies.json and the original lockfile. General-purpose build
tools are referenced, not installed or vendored as new dependency installations.

For a future recipient rebuild (not executed during preparation): extract the
archive into an editable directory, restore dependencies using npm ci there,
then invoke its local Rollup CLI with -c rollup.config.release.js. The relevant
output is the global ExtPay IIFE at dist/ExtPay.js. Keep its interface compatible
with the recipient's application. The IIFE uses the resolver/CommonJS/URL-replace
plugins; terser minification is commented out. Upstream npm run dist has a
separate BSD/macOS-style sed post-step for sample manifests; direct Rollup avoids
that shell-specific post-step when producing the library file on Windows.

The original Node/npm versions are not pinned by upstream. These instructions
are supported by static source inspection, not a demonstrated bit-identical
rebuild on a current toolchain. Original distribution bytes are retained.

Polyfill0.7.0 commit: 93203c6995f282dab7370d463e079a2b8d81abbb
Preferred source is src/browser-polyfill.js with api-metadata.json, Gruntfile.js
and package.json. Its build script is grunt and its source snapshot has no npm
lockfile. Original build-tool ranges are retained; exact original build-tool
resolutions cannot be inferred. Its MPL source and licence remain available
independently of ExtPay's LGPL permission.