[Aschenbath]

Finite negative alpha values now clamp to 0 instead of becoming 1. For example, tinycolor("red").setAlpha(-0.5).toRgbString() returns "rgba(255, 0, 0, 0)"; the same correction applies to RGBA/HSLA/HSVA strings, object inputs, and fromRatio().

This intentionally changes the old negative-alpha behavior, which existing tests explicitly expected. Values above 1 still become 1, and non-numeric values, NaN, and both infinities retain the existing fallback of 1. Update those old expectations, add boundary and input-format regressions, document the normalization rules, and regenerate the distributed CJS/ESM/UMD copies.

Fixes #287.

Validation: 47 tests passed with 1 existing polyad skip in Deno 1.46.3 and 2.9.8, and in the generated CJS/ESM runners on Node 18.20.8 and 24.22.0. The new expectations produced 5 failures before the fix. Checkout and installed-package consumer checks passed 87,948 assertions across 36 entrypoint runs, including browser UMD realms and unchanged in-range color operations. Package-name require() and import() also passed.

Build note: the historical esm.sh Babel URLs no longer match the checked-in lock hashes. Distribution files were generated with the unchanged build.js, mapping those two imports to the same pinned npm versions (@babel/core@7.20.12, @babel/preset-env@7.20.2) and starting from a copy of the repository lockfile. The resulting library differences are limited to boundAlpha() and its comment; the repository build configuration and lockfile are unchanged.

Implemented and tested with OpenAI Codex, including an independent agent review.