feat: catch html5 JS syntax errors in validate and correct seek/merge docs

[dazzatronus]

What changed

Validate now checks html5 JS syntax offline. Each asset.js string is passed through new Function() during shotstack validate. A syntax error renders a completely blank clip with no render error (status: "done", no error field) — this is the only feedback loop before spending credits.

Skill docs corrected with findings from real renders:

• onUpdate does not fire under seek. The harness seeks the GSAP timeline to each frame timestamp without playing through, so DOM mutations in onUpdate callbacks (textContent, innerHTML, class swaps) never appear in the rendered video. The count-up snippet — the most referenced data-display pattern — used onUpdate to mutate textContent and produced $0 in every frame. Replaced with a bake-and-reveal pattern: final values in HTML, animate opacity/transform only.
• Merge fields resolve in html5 css and js, not just html. Added an Edit-wide merge fields section to agent-core.md covering rules (UPPER_SNAKE_CASE, case sensitive, whitespace inside braces ignored), where they resolve (every string value in the Edit), when to use merge vs baking at generation time, and the ?data=true&merged=true status check.
• Documented silent blank-frame failure in troubleshooting.md and html5.md common mistakes: JS syntax or runtime errors produce blank clips with status: "done" and no error.

How to verify

bun test                    # 96 pass, 0 fail (3 new tests for JS syntax check)
bun run typecheck           # clean
shotstack validate broken.json  # catches )var syntax error with exit 1

The )var pattern that caused the original blank-frame bug is caught:

✗ timeline.tracks[0].clips[0].asset.js: asset.js has a syntax error — the html5 clip will render completely blank with no render error. Unexpected identifier