chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/browser-rpc/browser-rpc-contract.test.ts

@@ -6,6 +6,7 @@ import {
   composeBrowserRpcRequestEncoderRegistry,
   defineBrowserRpcOperation,
   defineBrowserRpcProviderProfile,
+  installBrowserRpcContractBindings,
   validateBrowserRpcContractBindings,
   type BrowserRpcProviderProfile,
 } from "../../../src/contracts/browser-rpc.ts";
@@ -23,6 +24,91 @@ import {
 } from "./fixture.ts";
 
 describe("Browser RPC contract registry", () => {
+  it("snapshots installed bindings before later source mutation", () => {
+    const operations: Record<string, ReturnType<typeof unaryOperation>> = {
+      GET_RPC_RESOURCE: unaryOperation(),
+    };
+    const installed = installBrowserRpcContractBindings({
+      operations,
+      profiles: { [unaryProfile().runtimeProfileId]: unaryProfile() },
+      schemaCodecs: SCHEMA_CODECS,
+      mappers: MAPPERS,
+      requestEncoders: { RpcResourceRequestEncoder: UNARY_ENCODER },
+    });
+    const before = installed.operations.get("GET_RPC_RESOURCE");
+    expect(before?.totalDeadlineMs).toBeDefined();
+
+    // R-04. A post-validation mutation of the source registry must not reach
+    // the installed snapshot.
+    operations.GET_RPC_RESOURCE = {
+      ...operations.GET_RPC_RESOURCE!,
+      totalDeadlineMs: 999_999,
+    };
+    expect(installed.operations.get("GET_RPC_RESOURCE")).toBe(before);
+    expect(
+      installed.operations.get("GET_RPC_RESOURCE")?.totalDeadlineMs,
+    ).not.toBe(999_999);
+  });
+
+  it("rejects extra accessor and symbol keys without invoking getters", () => {
+    let getterCalls = 0;
+    const accessorOperation = Object.defineProperty(
+      { ...unaryOperation() },
+      "totalDeadlineMs",
+      {
+        enumerable: true,
+        configurable: true,
+        get() {
+          getterCalls += 1;
+          return 1_000;
+        },
+      },
+    );
+    expect(() =>
+      installBrowserRpcContractBindings({
+        operations: { GET_RPC_RESOURCE: accessorOperation },
+        profiles: { [unaryProfile().runtimeProfileId]: unaryProfile() },
+        schemaCodecs: SCHEMA_CODECS,
+        mappers: MAPPERS,
+        requestEncoders: { RpcResourceRequestEncoder: UNARY_ENCODER },
+      }),
+    ).toThrow(TypeError);
+    expect(getterCalls).toBe(0);
+
+    const extraKeyOperation = {
+      ...unaryOperation(),
+      unexpectedKey: "smuggled",
+    };
+    expect(() =>
+      installBrowserRpcContractBindings({
+        operations: {
+          GET_RPC_RESOURCE: extraKeyOperation as never,
+        },
+        profiles: { [unaryProfile().runtimeProfileId]: unaryProfile() },
+        schemaCodecs: SCHEMA_CODECS,
+        mappers: MAPPERS,
+        requestEncoders: { RpcResourceRequestEncoder: UNARY_ENCODER },
+      }),
+    ).toThrow(/unexpected key/u);
+
+    const symbolRegistry: Record<string, unknown> = {
+      GET_RPC_RESOURCE: unaryOperation(),
+    };
+    Object.defineProperty(symbolRegistry, Symbol("hidden"), {
+      enumerable: true,
+      value: unaryOperation(),
+    });
+    expect(() =>
+      installBrowserRpcContractBindings({
+        operations: symbolRegistry as never,
+        profiles: { [unaryProfile().runtimeProfileId]: unaryProfile() },
+        schemaCodecs: SCHEMA_CODECS,
+        mappers: MAPPERS,
+        requestEncoders: { RpcResourceRequestEncoder: UNARY_ENCODER },
+      }),
+    ).toThrow(/symbol keys/u);
+  });
+
   it("closes exact operation, provider, schema, mapper and encoder bindings", () => {
     const operation = unaryOperation();
     const profile = unaryProfile();