chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/contracts/web-push.ts

@@ -161,10 +161,41 @@ export type WebPushObservationEvent =
   | "web_push_click_dispatched"
   | "web_push_association_revoked";
 
+/**
+ * WP-06. Bounded fan-out is a deliberate policy, but reporting a truncated pass
+ * as plain success hid the fact that only part of the set was handled.
+ */
+export type WebPushCountBucket =
+  | "0"
+  | "1_8"
+  | "9_32"
+  | "33_64"
+  | "GT_64";
+
+export function webPushCountBucket(count: number): WebPushCountBucket {
+  if (!Number.isFinite(count) || count <= 0) return "0";
+  if (count <= 8) return "1_8";
+  if (count <= 32) return "9_32";
+  if (count <= 64) return "33_64";
+  return "GT_64";
+}
+
+/**
+ * WP-07. Certainty of a user-visible native effect. It is evidence only and
+ * never authorizes a retry.
+ */
+export type WebPushNativeEffectCertainty =
+  | "CONFIRMED"
+  | "NOT_APPLIED"
+  | "MAYBE_APPLIED";
+
 export type WebPushObservation = Readonly<{
   event: WebPushObservationEvent;
   outcome: "SUCCEEDED" | "FAILED" | "DEGRADED";
   reason?: WebPushFailureCode | WebPushUnavailableReason;
+  countBucket?: WebPushCountBucket;
+  truncated?: boolean;
+  nativeEffect?: WebPushNativeEffectCertainty;
 }>;
 
 export interface WebPushObserver {