feat: deliver ontology-first Playground compile and provider-ready generation

[windforce19820520-ai]

Summary

Delivers the ontology-first Playground foundation plus PR A, PR B, and PR C in one reviewable branch.

• completes the deterministic semantic closure and Guard-protected reference isolation from Playground PR 0
• adds a mobile-friendly standalone Web Host with image upload, ScenarioPack-derived role slots, all 30 visual-composition presets, and readable Compile output
• adds deterministic Mock generation and accepted-request-only materialization
• adds allow-listed Seedream 4.0 and Grok Imagine profiles, Provider-specific request bridges, and request-scoped BYOK integration
• keeps real network transports absent by default and requires an injected deployment transport, explicit one-call confirmation, capability approval, plan binding, budget, rate, and render gates
• connects the private Playground to the source workspace so frozen-lockfile CI tests the exact Core and Contracts checkout
• updates the Playground usage and Provider capability documentation

Why

The Playground must show and send the same VOCE-generated semantic result. It cannot display an ontology-derived plan and then use a separately handwritten model prompt.

The first implementation review also found concrete runtime and safety gaps. This update fixes them:

• the page now fetches the composition catalog instead of reading a missing metadata field
• valid SemVer profile versions allow Seedream and Grok to compile
• Compile is provider-neutral and remains available even when the selected Provider cannot generate the plan
• Grok's three-reference limit blocks four/five-reference Generate without dropping references or switching Provider
• plan bindings use an immutable full Playground profile digest and bind the deterministic generation request
• BYOK is passed separately for one attempt and excluded from contracts, hashes, traces, logs, receipts, and responses
• upload dimensions, media, aspect ratio, JPEG EXIF removal, per-session/global memory limits, expiry, and all-outcome cleanup are enforced
• Grok input/output pricing, per-currency daily budgets, UTC day reset, concurrency, and documented rate limits are enforced
• pnpm now installs and links the private Playground as the sixth source workspace instead of leaving its package imports unresolved in CI

User impact

A user can open the page, upload declared references, select a composition and Provider, and inspect the complete compiled plan without a key. When rendering is explicitly enabled:

• Mock can generate deterministically at zero cost
• Seedream can use an injected approved transport and one ephemeral user key
• Grok can generate only plans within its declared three-reference limit
• every Generate attempt clears request images and credential state

Boundaries

This PR does not include PR D:

• no public deployment
• no shared operator credential
• no production telemetry or feedback handoff
• no automatic retry or paid fallback
• no real or paid Provider call in development or CI
• no production-readiness claim

Real Provider network transports remain absent by default and must be supplied by an approved deployment Host. The source workspace uses workspace:*; a separately deployed Playground must pin the exact published RC required by the design.

Validation

• frozen-lockfile install passed and recognized all 6 workspace projects
• repository validation passed (46 required files)
• TypeScript build passed
• full repository suite: 156 tests, 154 passed, 0 failed, 2 Windows symlink tests skipped because symlink creation is unavailable
• Playground suite: 37 passed, 0 failed
• real HTTP page/meta/composition/upload/compile/generate paths covered
• Seedream and Grok request bridges covered with injected recording transports only
• security gate passed: 11 cases, 2 environment skips; network gate passed
• real/paid Provider calls: 0
• final source commit: 64c32f3