chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/fixture-node-modules.test.ts

@@ -0,0 +1,89 @@
+import { mkdtemp, mkdir, readdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { describe, expect, it } from "vitest";
+
+import { linkFixtureNodeModules } from "../../scripts/lib/fixture-node-modules.ts";
+
+/**
+ * A removal or provider fixture runs `pnpm` inside a throwaway copy of the
+ * repository. pnpm does not recognise the modules directory it finds there and
+ * purges it, and with `CI=true` it does so without a prompt. When
+ * `<fixture>/node_modules` was a single directory symlink, that purge followed
+ * the link and deleted the repository's own installed dependencies mid-run —
+ * a test suite uninstalling the workspace it was running in.
+ */
+describe("fixture node_modules linking", () => {
+  async function sourceTree() {
+    const source = await mkdtemp(path.join(tmpdir(), "fixture-source-"));
+    const modules = path.join(source, "node_modules");
+    await mkdir(path.join(modules, "left", "lib"), { recursive: true });
+    await mkdir(path.join(modules, "@scope", "right"), { recursive: true });
+    await mkdir(path.join(modules, ".bin"), { recursive: true });
+    await writeFile(path.join(modules, "left", "lib", "index.js"), "export default 1;\n");
+    await writeFile(path.join(modules, "@scope", "right", "package.json"), "{}\n");
+    await writeFile(path.join(modules, ".modules.yaml"), "{}\n");
+    return source;
+  }
+
+  it("survives a recursive delete of the fixture's node_modules", async () => {
+    const source = await sourceTree();
+    const fixture = await mkdtemp(path.join(tmpdir(), "fixture-root-"));
+    try {
+      await linkFixtureNodeModules(fixture, source);
+
+      // The fixture resolves the same packages...
+      expect(
+        await readFile(
+          path.join(fixture, "node_modules/left/lib/index.js"),
+          "utf8",
+        ),
+      ).toContain("export default 1;");
+      expect(
+        (await readdir(path.join(fixture, "node_modules"))).sort(),
+      ).toEqual([".bin", ".modules.yaml", "@scope", "left"]);
+
+      // ...and this is exactly what pnpm's purge does.
+      await rm(path.join(fixture, "node_modules"), {
+        recursive: true,
+        force: true,
+      });
+
+      // The repository's real dependencies are untouched.
+      expect(
+        await readFile(
+          path.join(source, "node_modules/left/lib/index.js"),
+          "utf8",
+        ),
+      ).toContain("export default 1;");
+      expect(
+        await stat(path.join(source, "node_modules/@scope/right/package.json")),
+      ).toBeDefined();
+      expect(
+        (await readdir(path.join(source, "node_modules"))).sort(),
+      ).toEqual([".bin", ".modules.yaml", "@scope", "left"]);
+    } finally {
+      await rm(source, { recursive: true, force: true });
+      await rm(fixture, { recursive: true, force: true });
+    }
+  });
+
+  it("creates node_modules as a real directory, never a symlink", async () => {
+    const source = await sourceTree();
+    const fixture = await mkdtemp(path.join(tmpdir(), "fixture-root-"));
+    try {
+      await linkFixtureNodeModules(fixture, source);
+      const { lstat } = await import("node:fs/promises");
+      const entry = await lstat(path.join(fixture, "node_modules"));
+      expect(entry.isSymbolicLink()).toBe(false);
+      expect(entry.isDirectory()).toBe(true);
+      expect(
+        (await lstat(path.join(fixture, "node_modules/left"))).isSymbolicLink(),
+      ).toBe(true);
+    } finally {
+      await rm(source, { recursive: true, force: true });
+      await rm(fixture, { recursive: true, force: true });
+    }
+  });
+});