build(audience): add tsup.cdn.js for single-file IIFE CDN bundle

- Produces dist/cdn/imtbl-audience.global.js as a minified, source-mapped IIFE.
- Inlines @imtbl/audience-core via noExternal so the bundle has no runtime dep resolution.
- Substitutes __SDK_VERSION__ at build time; dev builds get 0.0.0-local for visibility.
- Uses clean: false so it runs alongside tsup.config.js without wiping dist/browser and dist/node.
- Not yet wired into pnpm build — next commit.

Refs SDK-115

Author: ImmutableJeffrey

packages/audience/sdk/tsup.cdn.js

@@ -0,0 +1,53 @@
+// @ts-check
+import { defineConfig } from 'tsup';
+import { replace } from 'esbuild-plugin-replace';
+import pkg from './package.json' with { type: 'json' };
+
+/**
+ * CDN bundle config for @imtbl/audience.
+ *
+ * Produces a single-file IIFE at dist/cdn/imtbl-audience.global.js that
+ * studios load via <script>. Bundles audience-core directly (no runtime
+ * dependency resolution), attaches globals via the src/cdn.ts side-effect
+ * entry point, and minifies for size.
+ *
+ * Runs alongside the main ESM build configured in tsup.config.js — they
+ * share the dist/ directory so `clean: false` is required to avoid wiping
+ * the ESM output. The package.json build script runs transpile (ESM/CJS)
+ * first, then transpile:cdn, then typegen, so the order-dependent dist/
+ * state is well-defined.
+ *
+ * The esbuild replace plugin substitutes '__SDK_VERSION__' with the
+ * actual package version at build time. Both @imtbl/audience and
+ * @imtbl/audience-core use '__SDK_VERSION__' as a placeholder in their
+ * source (config.ts / context.ts) so the real version gets stamped
+ * into context.libraryVersion on every message. Without this replacement
+ * the CDN bundle ships the literal placeholder and the backend 400s.
+ *
+ * Local dev builds have pkg.version === '0.0.0' because the real version
+ * is only written by `pnpm nx release version` in the publish workflow.
+ * We substitute '0.0.0-local' in that case so a hand-carried local build
+ * shows up as obviously non-production in context.libraryVersion logs.
+ */
+export default defineConfig({
+  entry: { 'imtbl-audience': 'src/cdn.ts' },
+  format: ['iife'],
+  outDir: 'dist/cdn',
+  outExtension: () => ({ js: '.global.js' }),
+  minify: true,
+  sourcemap: true,
+  clean: false,
+  target: 'es2018',
+  platform: 'browser',
+  dts: false,
+  // IIFE has no runtime module resolution, so every dep (including third-party
+  // npm deps) must be inlined. Can't reuse BUNDLED_WORKSPACE_DEPS from the sibling
+  // tsup.config.js — that list is workspace-only and would leave third-party deps
+  // as externals, breaking the <script>-tag use case.
+  noExternal: [/.*/],
+  esbuildPlugins: [
+    replace({
+      __SDK_VERSION__: pkg.version === '0.0.0' ? '0.0.0-local' : pkg.version,
+    }),
+  ],
+});