🚀 chore(browser,core): prepare 2.1.0 and 3.2.0 releases

[leoromanovsky]

Motivation

Release the browser obfuscated-key support and IndexedDB persistence tested in Eppo QA.

Changes and Decisions

• Prepare @datadog/openfeature-browser@2.1.0 and its required @datadog/flagging-core@3.2.0 dependency.
• Add release notes for obfuscation, persistence, tracking fixes, and upgrade behavior. Correct the outdated fixed-versioning instructions in AGENTS.md.
• Keep Node.js at 2.4.0; update its workspace core pin, but do not release it.
• After merge, publish core first, then browser, using their package-specific tags. This PR does not create tags or publish packages.

Validation

• Eppo QA runs the same implementation from main e37fc723a10e50e9d979a522b1d590f5ce2a8dee. Inspection of the deployed app's IndexedDB confirmed the received obfuscated response, salt, and all 198 flags were persisted. That live session did not exercise exposure logging.
• Fresh CORS preflight checks passed on staging and US1, US3, US5, AP1, AP2, UK1, and EU1. Each endpoint allows the new capability header and returns HTTP 204.

Staging

Deployed this build to qa.eppo.cloud

https://github.com/Eppo-exp/eppo/pull/14423

[github-actions]

OpenFeature Browser Provider Bundle Sizes

Measured from the Vite production output after installing packed @datadog/flagging-core and @datadog/openfeature-browser tarballs.

Both scenarios initialize an OpenFeature provider, evaluate a boolean flag, change context, and evaluate again. Telemetry is disabled for DatadogProvider; no tracking hooks are registered for DatadogCoreProvider. DatadogProvider fetches precomputed assignments for each context; DatadogCoreProvider receives rules from fetchRulesConfiguration once and evaluates locally.

Sizes include OpenFeature and the same small scenario harness. Configuration responses are supplied by Playwright and are not bundled. These are complete scenario JS sizes, not configuration payload sizes or isolated provider/Protobuf costs; the difference between rows is not a decoder-only delta.

Scenario	HTML	JS Assets	Raw JS	Gzip JS	Protobuf Markers
DatadogProvider (precomputed fetching)	provider.html	19	82.9 KiB	31.4 KiB	no
DatadogCoreProvider + fetchRulesConfiguration	core-provider.html	14	149.3 KiB	46.8 KiB	yes

Dependency checks passed: no Protobuf markers in default/precomputed scenarios; markers present in rules-based scenarios.

OpenFeature Browser Tracking Hook Bundle Sizes

Synthetic entrypoints import and call tracking hook factories from the packed @datadog/openfeature-browser/rules-based ESM package. Deltas are measured against the no-hook baseline from the same Vite production build.

Scenario	HTML	JS Assets	Raw JS	Raw Δ	Gzip JS	Gzip Δ
tracking hook baseline	tracking-baseline.html	6	2.6 KiB	0 B	1.6 KiB	0 B
exposure logging hook	tracking-exposure.html	14	56.9 KiB	+54.3 KiB	22.1 KiB	+20.5 KiB
evaluation logging hook	tracking-evaluation.html	14	53.2 KiB	+50.6 KiB	20.8 KiB	+19.2 KiB
RUM tracking hook	tracking-rum.html	10	5.1 KiB	+2.5 KiB	3.0 KiB	+1.4 KiB
all tracking hooks	tracking-all.html	17	61.2 KiB	+58.6 KiB	24.1 KiB	+22.5 KiB

OpenFeature Node Server Bundle Sizes

Independent Webpack production builds of the installed core and Node SDK tarballs, targeting Node 18 with ESM (module export condition). Node built-ins remain external. OpenFeature, dd-trace, and configuration fixtures are not bundled.

Scenario	Raw JS	Gzip JS	Protobuf Modules
Node provider only	36.3 KiB	11.5 KiB	no
SSR helpers only (fetch client rules + serialize)	80.1 KiB	23.1 KiB	yes
Node provider + SSR helpers	115.9 KiB	33.6 KiB	yes

Adding SSR helpers to the provider adds 79.7 KiB raw / 22.1 KiB gzip in this build. This includes fetching, parsing, and serialization, not just the decoder. SSR helpers fetch rules for the browser, not for configuring that provider (which uses its existing JSON API).

These are bundler sizes, not npm install sizes, unbundled Node require/import costs, payload sizes, or latency. Gzip compares compressed artifacts. The browser scenarios include OpenFeature and a different harness, so their sizes are not directly comparable.

Dependency checks passed: no Protobuf runtime or generated schema modules in the provider-only bundle; present in both SSR bundles (checked using Webpack module statistics).

This report shows current PR artifact sizes only; it does not compare against the base branch.