Modernise packaging and rewrite as a function component

[tanem]

Modernises the package for v18. Every ticket landed as its own commit on this branch rather than as interim PRs: .github/workflows/release.yml runs on a Monday cron against master with no gate, so a half-landed major would publish itself.

Full consumer-facing detail is in MIGRATION.md. Summary:

Breaking

• React floor raised to 16.8 (^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0), and ReactSVG is now a function component built on hooks. ref resolves to the wrapper DOM element instead of the class instance, re-injection is limited to props that affect the injected SVG, and the State type export is gone.
• exports map added. Paths into dist are no longer reachable. Top-level main / module / types stay for webpack 4 and TypeScript node10.
• Build moved to tsdown. Output filenames changed (dist/react-svg.cjs / .mjs, with .d.cts / .d.mts); output still targets ES2019 and @babel/runtime is no longer a runtime dependency.
• UMD builds dropped. React itself stopped shipping UMD in v19, so script-tag usage already required pinning React 18 or earlier.
• propTypes dropped. TypeScript types are the supported prop contract.
• Separate CJS dev/prod builds collapsed into one unminified build.

Non-breaking

• "use client" in the published bundles.
• sideEffects: false.
• CI gates: publint, arethetypeswrong and a size-limit budget.
• README gained "When To Use This", "Security" and "Contributing" sections.
• Agent instructions consolidated into root AGENTS.md; .github/copilot-instructions.md deleted now that Copilot code review reads AGENTS.md.
• No engines field: yarn classic hard-fails installs on a mismatch, and the package has no actual Node floor.
• Renovate now labels runtime dependency bumps bug rather than internal, so they stop being filed under Internal in the changelog, and majors are held for review as breaking.

Verification

• npm test green, including the React matrix (16.8, 16.14, 17.0, 18.0, 18.3, 19.0, 19.1).
• publint and attw green in all four modes; ESM resolves to ESM.
• All 17 examples were run against an npm pack tarball of this branch and render their SVG; examples/ssr additionally builds, serves and hydrates under next build && next start with a clean console. The v18 packaging needed no fixes. Three pre-existing example bugs surfaced and were fixed along the way.

Supersedes #3593, whose "use client" work landed here as efc30231.

[tanem]

Code review

Found 1 issue:

1. The new test/bundles.spec.ts reads dist/ but is also matched by config/jest/config.src.js's testMatch (<rootDir>/test/*.spec.ts?(x)), so npm run test:src now fails with ENOENT on a checkout with no dist/. Verified with npx jest --config ./config/jest/config.src.js --listTests, which lists bundles.spec.ts alongside browser.spec.tsx and node.spec.ts. The sibling configs scope explicitly to <rootDir>/test/browser.spec.tsx, so only the src config picks it up. (AGENTS.md says "npm run test:src is the development loop" and scopes the build prerequisite to npm run size and the package:* checks.)

react-svg/test/bundles.spec.ts

Lines 10 to 18 in 24fe4c0

	describe.each(entryPoints)('%s', (entryPoint) => {
	it('should start with the "use client" directive', () => {
	const contents = fs.readFileSync(
	path.join(process.cwd(), 'dist', entryPoint),
	'utf8',
	)
	expect(contents).toMatch(/^["']use client["']/)
	})
	})

react-svg/config/jest/config.src.js

Lines 30 to 32 in 24fe4c0

	testEnvironment: 'jsdom',
	testMatch: ['<rootDir>/test/*.spec.ts?(x)'],
	transform: { '^.+\\.([cm]?js|tsx?)$': 'ts-jest' },

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[tanem]

Fixed in 9860947, addressing the review finding above.

test/node.spec.ts had the same dependency via require('..'), which resolves through the exports map into dist/, and was passing vacuously without a build — a "Cannot find module" error still satisfies not.toThrow('ReferenceError: window is not defined'). Both specs now run under a new test:dist, which the full gate reaches after build; config.src.js keeps its glob so a new spec still runs in the development loop by default.