feat!: require a user-provided Temporal (remove bundled shim) and fix non-Gregorian locale values

[dogmar]

Audit fix C, which grew into a Temporal-provisioning change. Breaking.

Summary

1. Fix non-Gregorian locale values (the original audit finding). onMonthChange, rootState.viewing, and NavButtonState.target were built with PlainYearMonth.from({ year, month, calendar: localeCalendar }) — feeding ISO year/month numbers in as locale-calendar fields. Under a real Temporal implementation this reinterprets them (e.g. th-TH Buddhist: ISO June 2026 → 1483-06-10[u-ca=buddhist], ~543 years off). These values are now built in ISO; the locale only affects display.

2. Remove the bundled Temporal shim; require a user-provided Temporal. The library no longer ships a Temporal implementation.

Breaking change

The Temporal value export is removed from the package barrel and from every @klinking/colander/* format subpath. Consumers must now provide a Temporal implementation via the temporal prop (or run where native Temporal exists). resolveTemporal is provided → native globalThis.Temporal → throw; the error and the temporal prop TSDoc point to two recommended polyfills:

• temporal-polyfill (fullcalendar)
• @js-temporal/polyfill (js-temporal)

import { Temporal } from "temporal-polyfill";
<MonthView temporal={Temporal} … />

This deletes the temporal-polyfill module (~960 LOC incl. test) and drops the ~148KB Gregorian engine the audit flagged from the bundle.

Display formatting

MonthYearString now formats the month label through the provided Temporal — T.PlainDate.from({ year, month, day: 1 }).toLocaleString(locale, opts) — instead of new Date(...). (Not PlainYearMonth.toLocaleString, which throws on any iso8601-vs-locale calendar mismatch — even en-US; an iso8601 PlainDate is the documented Intl exception and adopts the locale's calendar, so th-TH still renders the Buddhist era 2569.) Both recommended polyfills implement this.

Notes / decisions

• The temporal prop stays optional in the type — native Temporal is still valid; the requirement is enforced at runtime and documented. No hard peerDependency added (two valid packages + native; documented instead).
• calendarForLocale (which only existed to feed the buggy calendar injection) was removed.
• Tests run against @js-temporal/polyfill; the "mini polyfill" matrix entry and shim-specific tests are gone. Follow-up Run the full test suite against both temporal-polyfill and @js-temporal/polyfill #16 tracks matrixing the whole suite over both polyfills.
• Still deferred (separate, larger surface — selected ZonedDateTime + timezone, and a locale-prop-driven component): DateString/TimeString and MonthSeparator still format via native Date.

Tests

• th-TH coverage: onMonthChange and rootState.viewing emit ISO (RED before the fix); NavButtonState.target is ISO; the label still localizes to the Buddhist era; a controlled round-trip doesn't jump centuries.
• vp run ready: lint+typecheck 0/0, all suites green.

🤖 Generated with Claude Code