chore: sync the frontend template from a0fbafb to 5434760

Carries eight template commits: the provider sandbox actually running, release
admission to a named environment, the product feature manifest with its runtime
kill switch, architecture and documentation rules that match what is enforced,
the removability fixtures, and the browser, visual and performance evidence.

Product identity is unchanged. `package.json` keeps `tech-log-frontend` and the
catalog keeps the Tech Log naming; the home page was not in the delta. The
visual baselines are this product's own — the template's were excluded from the
transplant and these were regenerated here, where the only difference is the
platform overview's new product-feature section.

What this repository gains operationally: `config/runtime/{local,development,
staging,production}.json` with `FE-GATE-027` refusing an artifact whose runtime
document does not match the environment it is being admitted to, and
`FEATURE_OVERRIDES` for taking an installed feature out of service without a
rebuild.

Verified here: eight gates green, build green, visual 5/5, and 1,858 of 1,859
tests in the suites that do not need a sandbox — the one failure passes in
isolation and is a jsdom lazy-chunk timeout under parallel load. The provider
suites cannot run on this machine at all: `kernel.apparmor_restrict_unprivileged
_userns=1` makes `bwrap --unshare-net` fail, reproducible without any code from
either repository.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/task3-selective-integration.test.ts

@@ -6,6 +6,7 @@ import path from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
 
 import {
+  isReducedCiContractRun,
   loadCiGateContract,
   parseCiGateContract,
 } from "../../scripts/contracts/ci-gates.ts";
@@ -70,8 +71,19 @@ describe("selective Task 3 contract closure", () => {
       "--signal=SIGKILL",
       unit,
     ]);
+    // `bwrap --args FD` stops parsing at the first non-option and never hands
+    // the remainder back, so a command placed in the args file is dropped and
+    // bubblewrap exits with its usage text. Refusing `--` in the option stream
+    // is what keeps that silent no-sandbox launch from returning.
+    expect(() =>
+      encodeProviderBwrapInput(
+        ["--unshare-net", "--", "/usr/bin/prlimit"],
+        { PROVIDER_COMMAND: command },
+      ),
+    ).toThrow(/terminate the option stream/u);
     const frame = encodeProviderScopeFrame({
       bwrapInput: Buffer.from("private-bwrap-vector\0"),
+      bwrapCommand: ["/usr/bin/prlimit", "--nofile=64:64", "--", "/bin/sh", "-eu", "-c", 'exec /bin/sh -eu -c "$PROVIDER_COMMAND"'],
       reportPath: "/exact/report.json",
       reportDev: 12,
       reportIno: 34,
@@ -81,6 +93,27 @@ describe("selective Task 3 contract closure", () => {
       Buffer.from("private-bwrap-vector\0").toString("base64"),
     );
     expect(launch.join("\0")).not.toContain("private-bwrap-vector");
+    // The command vector rides on real argv, so it must never be able to carry
+    // the secret that the args file exists to hide.
+    expect(frame.subarray(4).toString("utf8")).not.toContain(credential);
+    expect(() =>
+      encodeProviderScopeFrame({
+        bwrapInput: Buffer.from("x\0"),
+        bwrapCommand: [],
+        reportPath: "/exact/report.json",
+        reportDev: 12,
+        reportIno: 34,
+      }),
+    ).toThrow(/bwrap command is invalid/u);
+    expect(() =>
+      encodeProviderScopeFrame({
+        bwrapInput: Buffer.from("x\0"),
+        bwrapCommand: ["prlimit"],
+        reportPath: "/exact/report.json",
+        reportDev: 12,
+        reportIno: 34,
+      }),
+    ).toThrow(/bwrap command is invalid/u);
   });
 
   it("removes only the pinned raw inode during parent-loss cleanup", async () => {
@@ -143,12 +176,15 @@ describe("selective Task 3 contract closure", () => {
       .toContain("package script missing: root -> missing");
   });
 
-  it("accepts only the canonical exact-count authority and rejects orphan retention", async () => {
+  // A removal fixture runs against a pruned contract on purpose, so the
+  // canonical counts do not describe it. Asserting them there failed the
+  // fixture for the reduction it exists to demonstrate.
+  it.skipIf(isReducedCiContractRun())("accepts only the canonical exact-count authority and rejects orphan retention", async () => {
     const canonical = await loadCiGateContract(process.cwd());
-    expect(canonical.gates).toHaveLength(26);
-    expect(canonical.commands).toHaveLength(81);
-    expect(canonical.gates.reduce((sum, gate) => sum + gate.commandIds.length, 0)).toBe(93);
-    expect(canonical.artifacts).toHaveLength(105);
+    expect(canonical.gates).toHaveLength(27);
+    expect(canonical.commands).toHaveLength(82);
+    expect(canonical.gates.reduce((sum, gate) => sum + gate.commandIds.length, 0)).toBe(94);
+    expect(canonical.artifacts).toHaveLength(107);
     expect(canonical.stages).toHaveLength(5);
     expect(canonical.retention.classes).toHaveLength(5);
 
@@ -157,7 +193,7 @@ describe("selective Task 3 contract closure", () => {
     expect(() => parseCiGateContract(orphan)).toThrow(/five canonical retention|orphan retention/u);
   });
 
-  it("rejects the retired validate-candidate-archive grammar", async () => {
+  it.skipIf(isReducedCiContractRun())("rejects the retired validate-candidate-archive grammar", async () => {
     const canonical = JSON.parse(
       JSON.stringify(await loadCiGateContract(process.cwd())),
     ) as Record<string, any>;