The server's 2.0 tokens and its CodeMirror build, pinned

ui/tokens.css from the server's dev (tokens.lock.json; repin to the beta tag
at release). scripts/fetch-vendor.sh copies the server's vendored CodeMirror and
Lezer modules into ui/vendor/, each checked against the server's own pin first,
with the bare module names rewritten to sibling files (the page has no import
map); vendor.lock.json records both hashes, and the script with no argument
verifies the copy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tokens.lock.json

@@ -1,5 +1,5 @@
 {
-  "tag": "v1.3.0",
-  "commit": "61cf4c267c983d5895dba3a609f90ae1efd891a0",
-  "sha256": "aff95291186b57693469cf1f80452fd9a9e460aa360d45ed94c2f4f979e10c6c"
+  "tag": "dev",
+  "commit": "f5b3dbb965823ade56d57bf5e1d09900eb5946f2",
+  "sha256": "2b0ae1e3b6d217a93698285a17a67553605ef3550e2b1d3123730b9775982cb2"
 }