docs: add ADRs for React wrappers, slots-vs-props, distribution, and runtime deps

[QuintonJason]

Description

Follow-on to the ADR work in the sibling ds-tokens repo. Pine already has ADRs 0001–0005; this adds four more for long-lived decisions that shape the codebase but weren't written down anywhere — the kind that get re-litigated when someone new asks "why is it like this?".

New ADRs

• 0006 — React wrappers via Stencil's output target. Why @pine-ds/react is a separately-published, generated package depending on core, and the lockstep-versioning cost.
• 0007 — Slots for content, props for configuration. The pervasive API principle (25 components expose <slot>s; the pds-button.icon prop is deprecated toward the start slot). Documents why content goes in slots, so it isn't re-decided per component.
• 0008 — Dual distribution via npm and CDN with a lazy loader. Counterpart to ds-tokens ADR-0004. Includes the sharp edge: CDN versions are pinned by hand and @pine-ds/core/@kajabi-ui/styles must be kept in sync (the consuming ERB even says so).
• 0009 — Vetted runtime deps for positioning and sanitization. @floating-ui/dom for overlays; DOMPurify for sanitizing consumer-supplied option markup in pds-combobox. Flags DOMPurify as load-bearing security — removing it reintroduces XSS.

Verification

Every claim checked against the code, not memory:

• reactOutputTarget in stencil.config.ts; @pine-ds/react deps on @pine-ds/core ^3.26.4.
• 25 components use <slot>; icon @deprecated → start slot confirmed.
• CDN snippet in README; main/module/unpkg/collection/loader entry points in package.json.
• @floating-ui/dom in combobox/multiselect/tooltip util; DOMPurify.sanitize in pds-combobox's sanitizeHtml.

Type of change

• This change requires a documentation update (docs-only)

How Has This Been Tested?

• other: docs-only; no code changes. Cross-references to ds-tokens ADR-0004 and to ADR-0003/0007 verified.

Checklist:

• I have performed a self-review of my code
• I have made corresponding changes to the documentation

---

Note

Low Risk
Documentation-only; no runtime, build, or dependency changes.

Overview
Adds four retrospective architecture decision records (0006–0009) and extends docs/adr/README.md so the index covers 0001–0009 instead of 0001–0005.

0006 documents generated @pine-ds/react via Stencil’s reactOutputTarget and lockstep publishing with @pine-ds/core. 0007 codifies “props for configuration, slots for content” (including pds-button icon → start slot) and points to sanitization in 0009. 0008 records dual npm + jsDelivr CDN distribution with a lazy loader and the manual CDN pin / core–styles version sync requirement. 0009 records @floating-ui/dom for overlays and DOMPurify in pds-combobox as load-bearing XSS defense when rendering consumer HTML.

No application or build code changes—documentation and cross-references only.

^{Reviewed by Cursor Bugbot for commit fbbad0b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[netlify]

✅ Deploy Preview for pine-design-system ready!

Name	Link
🔨 Latest commit	fbbad0b
🔍 Latest deploy log	https://app.netlify.com/projects/pine-design-system/deploys/6a54ecb7d35aa80008dd71a3
😎 Deploy Preview	https://deploy-preview-775--pine-design-system.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.