I ended up patching a function into loadImage that substituted base64 encoded copies of the graphics to get my copy working without disabling CORS in FireFox (file:// is automatically assumed to be dirty by default.).
Dunno why audio didn’t trip CORS, but I won’t complain if the offical version also gets a 830kb js file just to hold the additional code with the encoded files.