Reflect the previously-deferred items as done: gemini provider is fully wired
to native generateContent (vision + audio), unit-tested, with a note that live
use needs a real Google key. Document that get_stealth_script now takes
os/browser/locale/seed and returns a fingerprint, and that the evasion script
is templated to match it (coherent) — inject both together or share a seed.
Note reasoning-model <think> blocks are stripped before json parse. Record the
CAPTCHA_E2E_HEADED toggle, drop the done roadmap items, keep the honest note
that headless reCAPTCHA v2 usually won't mint a token, and call out the single
package-lock.json lockfile.
lukaszraczylo