fix(canvas): follow live on design revisions; execute react artifacts in a sandboxed frame

[Neonforge98]

Problem

Two follow-ups from the Canvas audit (PRs #709/#767/#768):

1. Stale Simulator after a design revision. A design revision acts on the live Canvas, but when the replay cursor had been parked by jump-from-chat (navigateToEvent), the up-to-cursor simulator event window excluded the incoming revision events. The Canvas looked stale until the session was reopened — verified on a real machine: the revision completed, the activity row showed the steps, yet the visible canvas kept the pre-revision content.

2. React canvases could not execute on desktop. The packaged CSP (script-src 'self' 'wasm-unsafe-eval') blocks react-live's new Function, and srcdoc iframes inherit the parent policy, so an inline-script srcdoc runtime cannot run either. After the audit fix the desktop showed a visible notice card instead of a silent blank — but the artifact still never ran.

Solution

1. CanvasDesignSurface snaps back to follow mode (goLiveAtom) when a design revision is submitted, so the revision streams and materializes in view.

2. Serve compiled react artifacts over a dedicated canvas-artifact:// URI scheme instead of host-document eval:

   • reactArtifactDocument.ts ports the cloud viewer's sandbox document (sucrase compile, React 18 UMD runtimes, error overlay, strict CSP with connect-src 'none'), so desktop and public share links run identical artifact semantics.
   • Rust CanvasArtifactStore (16 entries / 8 MiB, oldest evicts) behind a canvas_artifact_publish command; the protocol handler responds with its own CSP + nosniff + no-store headers, 404 for unknown ids.
   • ReactArtifactRunner publishes once per source hash and renders <iframe sandbox="allow-scripts" src="…canvas-artifact.localhost/<id>">; compile/publish failures surface in a visible alert. react-live removed.
   • App CSP only gains the scheme in frame-src; unsafe-eval stays out.

Security

The artifact frame is a separate, sandboxed, opaque origin. WebView2 does inject __TAURI_INTERNALS__ into subframes (wry injects init scripts for all frames), but IPC is unreachable through three independent layers, each verified: no capability grants any remote context; the IPC protocol rejects the opaque frame's Origin: null; and the artifact document's connect-src 'none' blocks the invoke transport outright. Live test from inside a real artifact frame: invoke() never completes (blocked at transport). sandbox must never gain allow-same-origin — pinned by tests.

Verification

• tsc --noEmit clean; canvas + CanvasInlineCard suites 19 files / 159 tests green (includes new reactArtifactDocument.test.ts, rewritten runner tests, and a regression test that a parked replay cursor snaps to follow on submit).
• Rust: cargo check -p org2 clean; store/protocol unit tests compile (the test exe cannot load on the dev machine due to a pre-existing comctl32 manifest issue; they should run on CI).
• Real machine (Windows, dev-build exe, CDP-driven, real Opus agent turn): a react canvas rendered live in the chat card through http://canvas-artifact.localhost/ra-… with sandbox="allow-scripts"; the button inside was clicked and cycled state (Rose → Amber) proving interactivity; the revised html canvas from the previous session renders its materialized state after restart.

Notes

• With >16 live artifacts the backend evicts oldest; a still-mounted evicted frame 404s (blank) until remount — accepted under the 16-entry budget.
• sucrase (~200 KB) + two React 18 UMD texts replace react-live in the bundle.