chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/contracts/mutation-intent.ts

@@ -23,6 +23,39 @@ function validBoundedString(value: unknown, maxBytes: number): value is string {
   );
 }
 
+/**
+ * N-06. The single idempotency-key authority shared by the V2 compatibility
+ * client and the V3 executor.
+ *
+ * A caller-supplied value is never trimmed, regenerated or silently dropped:
+ * an invalid key is a contract violation, because replaying a keyed command
+ * without its key is exactly the unsafe behaviour the key exists to prevent.
+ */
+export function isValidIdempotencyKey(value: unknown): value is string {
+  if (
+    !validBoundedString(
+      value,
+      MUTATION_INTENT_BOUNDS.idempotencyKeyMaxBytes,
+    )
+  ) {
+    return false;
+  }
+  for (const character of value) {
+    const codePoint = character.codePointAt(0) ?? 0;
+    if (codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+export function defineIdempotencyKey(value: unknown): string {
+  if (!isValidIdempotencyKey(value)) {
+    throw new TypeError("Idempotency key is invalid.");
+  }
+  return value;
+}
+
 export function defineMutationIntent(intent: MutationIntent): MutationIntent {
   if (
     !validBoundedString(
@@ -37,11 +70,11 @@ export function defineMutationIntent(intent: MutationIntent): MutationIntent {
       intent.canonicalInputIdentity,
       MUTATION_INTENT_BOUNDS.canonicalInputIdentityMaxBytes,
     ) ||
+    // OPT-NET-02. Intent definition and executor admission share one key
+    // authority; a second, looser rule here is how a control character reaches
+    // an `Idempotency-Key` header.
     (intent.idempotencyKey !== undefined &&
-      !validBoundedString(
-        intent.idempotencyKey,
-        MUTATION_INTENT_BOUNDS.idempotencyKeyMaxBytes,
-      )) ||
+      !isValidIdempotencyKey(intent.idempotencyKey)) ||
     !Number.isFinite(intent.createdAtMonotonicMs) ||
     intent.createdAtMonotonicMs < 0
   ) {