fix(overlay): mirror logical alignment and expose viewport bounds

[smiggleworth]

Closes #59.
Closes #60.

Summary

• resolve start/end as logical inline alignment from the trigger computed direction
• expose padded viewport width and height through stable overlay CSS custom properties
• document the headless position-only clamp boundary and a consumer sizing/wrapping recipe
• release @askrjs/ui@0.0.33

TDD evidence

• Red 3f9dba4d84626b6be5931785069ed6ce465494a1: real-browser regressions failed in Chromium, Firefox, and WebKit because RTL start/end stayed at the LTR physical positions and oversized content exposed no available-width hook.
• Green b72500f0492f57ef17ec59d86b6befa48b1c2a3d: the same 27 focused Popover behavior tests pass in all three engines after the shared positioning fix.
• Exact release head 1425184: the full npm run check gate passes unit, check, jsdom, three-engine browser, build, lint, types, publint, pack, and installed-package checks; all four benchmark tiers and npm audit --omit=dev pass.

Root causes and permanent guardrails

• The shared alignment helper interpreted start/end as physical coordinates. The implementation now reads the trigger computed direction for the horizontal cross axis. A standing real-layout regression fixes identical trigger geometry across LTR and RTL and cross-compares start/end positions in every supported browser engine.
• Position clamping cannot make intrinsically oversized headless content fit. The shared engine now exposes --ak-overlay-available-width and --ak-overlay-available-height, while the real-browser adversarial test preserves the documented position-only boundary using 400 unbroken characters in a narrow viewport. The docs give consumers an explicit max-size, overflow, and wrapping recipe.

Acceptance audit

• Reporter ownership and both issue contracts were read back from GitHub.
• Focused real-browser regressions were committed red before implementation and pass green.
• Permanent RTL and adversarial oversized-content guardrails cover the bug classes in all three engines.
• Headless sizing responsibility, logical alignment, and the supported reactive sizing hooks are documented.
• Full local release, package, benchmark, and production-audit gates pass at the exact release head.
• Exact-head hosted CI succeeds.
• Every linked issue acceptance checkbox is checked with evidence before ready-for-review and squash merge.
• v0.0.33 peels to the squash-merged main SHA, npm integrity is verified, and a clean consumer exercises the repaired overlay surface with a zero-vulnerability production audit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[smiggleworth]

Release proof

• Publish run https://github.com/askrjs/askr-ui/actions/runs/31940150832 completed successfully at squash merge 2b5e60c.
• Annotated tag v0.0.33 (tag object 08e60adfbe52c11d7c908a0a0a3abd1b51a5061c) peels to that exact merge.
• npm reports @askrjs/ui@0.0.33 with integrity sha512-TzTtlnnpTK/acDqS4nRop6nh5RJ88eZcD5IUersQiqU+UlAb6RxogVaEi97RGsiXfYlxcefX9q9IP3iVjytk2g==.
• A clean temporary consumer installed the exact registry version plus its resolved @askrjs/askr peer, imported Popover/PopoverContent/PopoverTrigger and Tooltip/TooltipContent/TooltipTrigger exclusively from public package subpaths, and rendered both compositions inside an RTL host through the public SSR and JSX runtimes.
• npm audit --omit=dev reports 0 vulnerabilities in the clean consumer.

All implementation, acceptance, and release criteria are now complete.