v1.3.1: scorecard polish + hide PNG link for SVG-only diagram types

[gregzuro]

Clears the items flagged on community.obsidian.md/plugins/obsidian-kroki and fixes the broken PNG action link for diagram types whose Kroki server doesn't generate PNG.

Source

• main.ts: document → activeDocument in the renderer and settings link helper (popout-window compatibility).
• main.ts: drop the General settings heading per Obsidian's style guide.
• main.ts: settings-textarea handler no longer hands addEventListener a Promise<void>.
• styles.css: #fff → #ffffff.
• manifest.json: trailing period on the description.

PNG action link

The PNG action link is now hidden for diagram types whose Kroki /png/ endpoint isn't implemented: bpmn, bytefield, d2, dbml, excalidraw, nomnoml, pikchr, svgbob, symbolator, wavedrom. Verified against kroki.io's support matrix and by probing each endpoint live (SVG=200, PNG=400/404).

The Edit link now uses the SVG URL — niolesk just decodes the source out of the encoded fragment, so format doesn't matter to it, and SVG is valid for every diagram type.

README and RELEASE_NOTES.md call this out.

Build / supply chain

• esbuild.config.mjs uses node:module's builtinModules instead of the builtin-modules dep, which is dropped from package.json.
• pako pinned to 2.1.0 (was ^2.1.0).
• package-lock.json is now committed; both workflows switched npm install → npm ci.
• publish.yml gained id-token: write + attestations: write permissions and an actions/attest-build-provenance@v2 step covering main.js, manifest.json, styles.css. Release body comes from RELEASE_NOTES.md.

Hygiene

• New CONTRIBUTING.md covering dev setup (nix develop or npm install), test-vault flow, and the release path.

Version

Bumped to 1.3.1 across manifest.json, package.json, versions.json.

Verification

• npm run lint and npm run build both clean. grep -c builtin-modules main.js → 0.
• Smoke-tested in a vault: settings tab no longer shows General, edits to per-type headers still persist, popout-window render path works.
• PNG link only appears for types where it actually downloads (e.g. PlantUML, GraphViz, Mermaid) and is absent for the 10 SVG-only types listed above.

Out of scope

• The three "scan not available" disclosures (malware, vulnerable deps, obfuscation) — should populate automatically on next release once the lockfile + attestation are in place.
• The atob/btoa and vault.read disclosures — intentional (Kroki URL encoding and @from_file: include).