## Library content externalised — loaded at runtime via sg.*, no longer inlined

- **`library.html` is now a thin renderer, not a 2 MB blob.** The library content —
  `assets/library/library.json` plus one webp per article — lives as vault data and is loaded at
  runtime through the SG bridge (`sg.vfs.readText` / `sg.vfs.read`), which is available both in the
  vault app iframe and on riskmandate.ai, with a relative-path fallback for any other context. The
  built page dropped from ~2.1 MB to ~50 KB.
- **Images lazy-load.** Article data is fetched on load; each infographic is fetched only as its
  card scrolls into view (IntersectionObserver, 300px margin) and turned into a blob URL, cached by
  path. The reading overlay loads the full figure on open. No `data:` URIs anywhere in the output —
  the contract scan and a new smoke assertion both enforce it.
- **Content is now decoupled from the page.** Adding or editing articles means editing
  `assets/library/` — no page rebuild. `build.js` still validates the content as a gate (referential
  integrity of `related`/`theme` + every referenced image present), so bad content fails the build.
- Net vault size is ~2 MB smaller (removed the inlined output and the duplicate `src` assets; the
  webps now live once under `assets/library/`).