chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/integration/http-client.test.ts

@@ -59,6 +59,88 @@ describe("shared HTTP client", () => {
     expect(attempts).toBe(3);
   });
 
+  it.each(["", "   ", "bad\u0000key", "x".repeat(513)])(
+    "rejects invalid keyed command key %j before credentials and fetch",
+    async (idempotencyKey) => {
+      let fetched = 0;
+      let credentialAttempts = 0;
+      server.use(
+        http.post("https://api.test/api/entities", () => {
+          fetched += 1;
+          return HttpResponse.json({ success: true, data: {} });
+        }),
+      );
+      const client = testClient({
+        baseUrl: "https://api.test",
+        clock,
+        authSession: {
+          getState: () => "authenticated",
+          subscribe: () => () => {},
+          beginSignIn: async () => {},
+          signOut: async () => {},
+          async credentialPatch() {
+            credentialAttempts += 1;
+            return { headers: {} };
+          },
+          recover: async () => "no-session" as const,
+          onUnauthenticated: () => {},
+        },
+      });
+
+      await expect(
+        client.execute("CREATE_ENTITY", {
+          body: { name: "n" },
+          idempotencyKey,
+        }),
+      ).resolves.toMatchObject({
+        ok: false,
+        error: {
+          kind: "VALIDATION_REJECTED",
+          code: "IDEMPOTENCY_KEY_INVALID",
+          // The repository reports attempt counts as 1-based; the invariant
+          // proved below is that no physical attempt happened at all.
+          attemptCount: 1,
+        },
+      });
+      expect(fetched).toBe(0);
+      expect(credentialAttempts).toBe(0);
+    },
+  );
+
+  it("bounds a non-cooperative legacy credential owner by total deadline", async () => {
+    let fetched = 0;
+    let observedSignal: AbortSignal | undefined;
+    server.use(
+      http.get("https://api.test/api/entities", () => {
+        fetched += 1;
+        return HttpResponse.json({ success: true, data: [] });
+      }),
+    );
+    const client = testClient({
+      baseUrl: "https://api.test",
+      timeoutMs: 5,
+      clock: { now: () => 0, sleep: async () => {} },
+      authSession: {
+        getState: () => "authenticated",
+        subscribe: () => () => {},
+        beginSignIn: async () => {},
+        signOut: async () => {},
+        credentialPatch: (_binding, context) => {
+          observedSignal = context?.signal;
+          // Never settles on its own.
+          return new Promise<never>(() => {});
+        },
+        recover: async () => "no-session" as const,
+        onUnauthenticated: () => {},
+      },
+    });
+
+    const result = await client.execute("LIST_ENTITIES");
+    expect(result).toMatchObject({ ok: false });
+    expect(fetched).toBe(0);
+    expect(observedSignal).toBeDefined();
+  });
+
   it("rejects a non-JSON response without exposing its body", async () => {
     server.use(
       http.get(