Fix cmd-click for auto events

[adriaandotcom]

Summary

Fixes #45.

Automatic link tracking still cancelled Cmd/Ctrl/Shift/Alt-clicks and redirected the current page when tracking completed. Preserve native link behavior and site handlers while reusing v12's existing keepalive transport for event delivery.

 on automatic link click
-  replace onclick, cancel navigation, redirect from tracking callback
+  send keepalive event and let the browser or website handle navigation

Refreshed against current v12, which includes freshly synchronized main, and resolved the original PR's conflicts. Event names, metadata, collection settings, and one-event-per-click behavior remain unchanged. The third-argument callback remains callable for custom tracker integrations.

Security implications

• No security impact
• Has security impact - described as:

Uses the existing tracking endpoint and payload; keepalive requests omit credentials. No extra collection is introduced.

Evidence

• Before: rebuilt current v12 cancels Cmd/Ctrl clicks; the focused local navigation/transport check fails.
• After: all 48 CDN/custom-helper DOM scenarios pass. Real Chrome confirms Cmd-click opens a new tab, plain click navigates immediately, and a cancelled click stays put, with exactly one event received in each case.
• With the same build/compression settings, each auto-events bundle shrinks from 3,039 to 2,601 bytes (1,447 to 1,292 gzip bytes). The core minified bundle grows by 4 bytes (1 gzip byte); light bundles are unchanged.

Testing

• Build, all 41 unit tests, all 12 deployment tests, TypeScript, formatting, and diff checks pass locally on Node 24.18.0 / pnpm 11.17.0.
• Standards and Spec reviews found no actionable issues.
• Current distributions and source maps are rebuilt. Existing pinned dist/v* files and SRI bytes are unchanged.
• BrowserStack and GitHub checks are reported separately from local validation.

Merge Danger

Door: two-way. Blast Radius: automatic link tracking.

Deploy the updated core tracker with the helper to enable keepalive delivery. Older/pinned core trackers that ignore the fourth event argument continue using image transport, so delivery during same-tab exits is best effort. The helper preserves native navigation with either version.

Checklist

• Linked to an issue
• Tested
• Requested review from adriaandotcom; GitHub rejects this because they are the PR author.