[mimalef70]

FontARA could get stuck after a temporary startup failure, accept stale UI snapshots or match lookalike hosts. Release retries also depended on expiring CI artifacts and coupled Firefox publishing to Chrome's outcome. This change fixes those failure modes and makes development and release checks enforceable.

• Recover startup and preserve settings revision order; enforce host boundaries through stored settings migration.
• Split the Options page into persistent feature controllers and typed sections without losing drafts, previews or consent state.
• Preserve verified packages through attested release provenance, add a deterministic CycloneDX production SBOM, decouple store retries/status, and retain a narrowly pinned 5.1.0 compatibility path.
• Add guarded version PR/tag commands, pinned Actions, actionlint, browser diagnostics and measured CPU/heap/DOM budgets.
• Document rollback, release operations and the repository controls enabled alongside this change: required CI/CodeQL, immutable admin-created tags, least-privilege tokens, Dependabot, secret scanning/push protection and private reporting.

Validation: pnpm verify passes (517 unit + 95 inject tests, coverage, all builds, package lint, version checks, dependency audits and reproducible ZIPs); 63 Chrome browser cases, all 7 Firefox cases and both production-package installation checks pass. One local Firefox session-creation failure passed on focused rerun. Native SBOM generation is byte-identical across runs. Actionlint and whitespace checks pass. Runtime regressions fail against the original implementation and pass with these fixes.

CodeQL review fixed all 11 actionable initial alerts, then hardened descriptor-based input reads and regex escaping for three additional PR findings. The 167 initial false positives and five PR false positives were individually reviewed and dismissed with recorded explanations; no blanket query suppression was introduced. The latest PR scan confirms zero open findings. Symlink/path-replacement regressions pass.

Hosted CI also exposed a performance-fixture readiness issue before any workload metrics were collected. The test now waits for runtime/content readiness, foreground visibility and initial font application before measuring; performance budgets remain unchanged. All 22 focused release security tests and the focused real Chrome performance check pass.

Historical contribution triage: incorporate the applicable return type from #156 and Edge installation documentation from #115. #108/#107/#85 overlap current icon protection and variable-font/swap behavior. #87/#75/#3 target the removed pre-v4 architecture and should be closed as superseded rather than merged into the current extension. No new store version is submitted by this PR; post-merge checks exercise live attestation and authenticated read-only store status.