Builds the dependency-less default password-strength estimator.
The heuristic scores length tiers (>= 8 / 12 / 16) plus character-class
diversity (lower, upper, digit, symbol) and subtracts a point for a run of
three or more identical characters, then clamps to 0..4. It ships no
dictionary - enterprises swap in zxcvbn or similar via
CNGX_PASSWORD_STRENGTH_FACTORY.