chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/browser-file-download.test.ts

@@ -248,12 +248,49 @@ describe("browser download delivery", () => {
       ok: true,
       value: { kind: "BROWSER_HANDOFF", transferId: "transfer:1" },
     });
+    // STO-02. Parse once, then execute exactly what was validated.
     expect(handoff).toHaveBeenCalledWith(
-      "/downloads/artifact-1",
+      "https://app.example/downloads/artifact-1",
       "invoice_exe.pdf",
     );
   });
 
+  it("executes the canonical target instead of a document-base-relative href", async () => {
+    const handoff = vi.fn();
+    const adapter = createDownloadDeliveryAdapter({
+      ...HARD_LIMITS,
+      policies,
+      host: { handoff },
+      // A relative href the host would otherwise resolve against a hostile
+      // document <base href="https://evil.example/">.
+      browserManagedCapabilities: capabilityResolver(() => "downloads/a"),
+      baseOrigin: "https://app.example",
+      createTransferId: () => "transfer:1",
+      userActivation: { isActive: true },
+    });
+
+    expect(
+      await adapter.deliver(
+        deliveryInput(
+          {
+            kind: "BROWSER_MANAGED_RESOURCE",
+            resourceId: "artifact-1",
+            capabilityReceipt,
+          },
+          "BROWSER_MANAGED",
+        ),
+      ),
+    ).toMatchObject({ ok: true });
+    expect(handoff).toHaveBeenCalledWith(
+      "https://app.example/downloads/a",
+      "invoice_exe.pdf",
+    );
+    for (const [href] of handoff.mock.calls) {
+      expect(String(href).startsWith("https://app.example/")).toBe(true);
+      expect(String(href)).not.toContain("evil.example");
+    }
+  });
+
   it("rejects cross-origin or query-bearing browser-managed targets", async () => {
     const handoff = vi.fn();
     const adapter = createDownloadDeliveryAdapter({