feat: vendor and censor the phishing blocklist at build time (closes #219)

eslint.config.js

@@ -125,6 +125,16 @@ module.exports = [
         },
     },
 
+    // The helpers the script/ entrypoints call: plain node programs too, run
+    // from a shell script rather than from yarn, and never bundled.
+    {
+        files: ["script/lib/**/*.js"],
+        languageOptions: {
+            ...commonjs,
+            globals: { ...globals.node },
+        },
+    },
+
     // The e2e harnesses are node programs that also carry, inline, the
     // callbacks they ship into the browser via page.evaluate — so both
     // contexts really are present in the same file and both sets of globals