chore: sync the frontend template from a0fbafb to 5434760

Carries eight template commits: the provider sandbox actually running, release
admission to a named environment, the product feature manifest with its runtime
kill switch, architecture and documentation rules that match what is enforced,
the removability fixtures, and the browser, visual and performance evidence.

Product identity is unchanged. `package.json` keeps `tech-log-frontend` and the
catalog keeps the Tech Log naming; the home page was not in the delta. The
visual baselines are this product's own — the template's were excluded from the
transplant and these were regenerated here, where the only difference is the
platform overview's new product-feature section.

What this repository gains operationally: `config/runtime/{local,development,
staging,production}.json` with `FE-GATE-027` refusing an artifact whose runtime
document does not match the environment it is being admitted to, and
`FEATURE_OVERRIDES` for taking an installed feature out of service without a
rebuild.

Verified here: eight gates green, build green, visual 5/5, and 1,858 of 1,859
tests in the suites that do not need a sandbox — the one failure passes in
isolation and is a jsdom lazy-chunk timeout under parallel load. The provider
suites cannot run on this machine at all: `kernel.apparmor_restrict_unprivileged
_userns=1` makes `bwrap --unshare-net` fail, reproducible without any code from
either repository.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/lib/ci-candidate-archive.ts

@@ -5,7 +5,6 @@ import type { FileHandle } from "node:fs/promises";
 import {
   lstat,
   mkdir,
-  mkdtemp,
   open,
   readFile,
   readdir,
@@ -28,6 +27,10 @@ import {
   assertSafePublishLeaf,
   ensureSafePublishDirectory,
 } from "./ci-gate-log.ts";
+import {
+  makePrivateTemporaryDirectory,
+  withPrivateUmask,
+} from "./private-filesystem.ts";
 
 const MAX_ARCHIVE_BYTES = 268_435_456;
 const MAX_CANDIDATE_FILES = 4_096;
@@ -147,11 +150,11 @@ export async function verifyCiCandidateArchive(
       path.dirname(extractionTarget),
     );
     await assertSafePublishLeaf(extractionTarget, input.extractTo);
-    extractionRoot = await mkdtemp(
+    extractionRoot = makePrivateTemporaryDirectory(
       path.join(path.dirname(extractionTarget), `.${path.basename(extractionTarget)}.verified-`),
     );
   } else {
-    extractionRoot = await mkdtemp(path.join(tmpdir(), "ci-candidate-archive-"));
+    extractionRoot = makePrivateTemporaryDirectory(path.join(tmpdir(), "ci-candidate-archive-"));
   }
   let published = false;
   try {
@@ -221,7 +224,7 @@ export async function verifyCapturedCiCandidateArchive(
     throw new Error("candidate archive SHA-256 mismatch");
   }
   const captured = await materializeCapturedArchive(archive);
-  const extractionRoot = await mkdtemp(path.join(tmpdir(), "ci-captured-candidate-"));
+  const extractionRoot = makePrivateTemporaryDirectory(path.join(tmpdir(), "ci-captured-candidate-"));
   try {
     const manifest = preflightArchiveHandle(captured.handle);
     extractArchiveHandle(captured.handle, extractionRoot);
@@ -318,25 +321,33 @@ function preflightArchiveHandle(archiveHandle: FileHandle): ReleaseCandidateMani
 }
 
 function extractArchiveHandle(archiveHandle: FileHandle, extractionRoot: string): void {
-  const extracted = spawnSync(
-    TAR_EXECUTABLE,
-    [
-      "--extract",
-      "--gzip",
-      "--file",
-      "/proc/self/fd/3",
-      "--directory",
-      extractionRoot,
-      "--no-same-owner",
-      "--no-same-permissions",
-    ],
-    {
-      encoding: "utf8",
-      maxBuffer: 1_048_576,
-      timeout: 30_000,
-      env: TAR_ENVIRONMENT,
-      stdio: ["ignore", "pipe", "pipe", archiveHandle.fd],
-    },
+  // `--no-same-permissions` is what keeps an untrusted archive from choosing
+  // its own modes, but it hands the decision to the inherited umask instead.
+  // Under a hardened `umask 077x` tar then creates directories it cannot
+  // descend into and extraction fails part-way. Pinning the umask for the
+  // duration makes the extracted tree exactly private, whatever the caller's
+  // ambient state is. `spawnSync` keeps this window free of interleaved work.
+  const extracted = withPrivateUmask(() =>
+    spawnSync(
+      TAR_EXECUTABLE,
+      [
+        "--extract",
+        "--gzip",
+        "--file",
+        "/proc/self/fd/3",
+        "--directory",
+        extractionRoot,
+        "--no-same-owner",
+        "--no-same-permissions",
+      ],
+      {
+        encoding: "utf8",
+        maxBuffer: 1_048_576,
+        timeout: 30_000,
+        env: TAR_ENVIRONMENT,
+        stdio: ["ignore", "pipe", "pipe", archiveHandle.fd],
+      },
+    ),
   );
   if (extracted.status !== 0 || extracted.signal || extracted.error) {
     throw new Error(
@@ -592,7 +603,7 @@ function readManifestFromArchive(archiveHandle: FileHandle): ReleaseCandidateMan
 async function materializeCapturedArchive(
   archive: Buffer,
 ): Promise<Readonly<{ root: string; handle: FileHandle }>> {
-  const root = await mkdtemp(path.join(tmpdir(), "ci-captured-archive-"));
+  const root = makePrivateTemporaryDirectory(path.join(tmpdir(), "ci-captured-archive-"));
   const file = path.join(root, "candidate.tar.gz");
   let handle: FileHandle | undefined;
   try {
@@ -601,6 +612,11 @@ async function materializeCapturedArchive(
       constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
       0o600,
     );
+    // `open` subtracts the umask too. The extractor re-opens this file by
+    // `/proc/self/fd/N` from a child process, and that re-open is a real
+    // permission check, so a umask-zeroed mode makes `tar` fail to read the
+    // candidate it was just handed.
+    await handle.chmod(0o600);
     await handle.writeFile(archive);
     await handle.sync();
     await unlink(file);