Ensure isomorphic runtime: audit Node-specific assumptions

[guidefari]

Summary

Audit the core package for any Node-specific assumptions that would break in browser, edge, or Deno runtimes.

Context

PRD: "The project should remain truly isomorphic, so core modules must not assume server-only globals, secret storage models, or transport behavior."

The browser package exists and works, but the core package should be audited to confirm no accidental Node dependencies leak in (e.g. Buffer, process, Node-only crypto).

Acceptance criteria

• Audit core package imports for Node-only APIs
• Document any intentional Node-only code paths
• Ensure spotify-effect core works with browser/edge bundlers

Related

PRD #9 — user stories 12, 38

---

Migrated from guidefari/spotify-effect#47