[Spec 027] Add real frontend CI and fresh-environment browser acceptance

[XnLemon]

Part of NeKiro-project/NeKiro#59 and Spec 027. Make frontend typecheck, focused tests, production build, and browser-level fresh-environment acceptance execute against the production Console while preserving #/demo comparison routes as isolated mock surfaces. Acceptance: CI fails when the frontend is not discovered, validates the visible Register -> Verify -> Publish -> Discover -> Install -> Invoke -> Record flow, covers JSON/SSE and exact errors, and scans for credential or challenge-proof leakage. Depends on the API client and operations UI slices.

[XnLemon]

T029 pre-implementation review completed by an independent subagent. Slice D policy is fixed: use @playwright/test with explicitly installed Chromium; build-time inject exact Gateway/provider/owner/Workspace values; use distinct provider and Workspace-owner principals/tokens; map the Gateway to a non-IP hostname such as gateway.nekiro.test; keep production / separate from the four exact #/demo routes; fail on missing prerequisites. No public contract or backend ADR is needed. Seed/fallback APIs, URL-validator relaxation, direct Agent/Router access, route interception, retry, reconnect, and alternate endpoints remain out of scope.

[XnLemon]

Spec 027 Slice D verification: PR #7 supplies the real production browser acceptance and isolated demo routes. Console CI runs 30254947242 and 30254944783 passed frontend and browser checks. Root PR #62 imports the reviewed source; root CI run 30319275997 passes all 7 checks, including console-browser-acceptance and backend-acceptance. The earlier failure was fixed by correcting internal-auth digest direction, with no fallback or alternate endpoint.

[XnLemon]

Slice D final delivery evidence (commit 3dad843):

• PR #64 remains stacked on Slice C PR #63 and is Console/CI/Spec-only; no Router, Control Plane, contract, database, direct Agent, or alternate endpoint changes.
• CI run 30329624757: all 8 checks passed, including frontend, go-quality, backend-acceptance, workspace-integration, runtime-samples-quality, compose-config, console-browser-acceptance, and Codecov.
• Local verification: pnpm test 41/41, pnpm typecheck, pnpm build, and git diff --check.
• The prior browser failure in run 30328793812 was diagnosed as the read-only Header status layer intercepting the Create Workspace control at the CI viewport. Commit 3dad843 adds pointer-events-none to that status layer; the fresh browser acceptance passed.
• Final independent review of 253c187..3dad843: 0 High / 0 Medium / 0 Low.
• Fallback delta: removed 1 implicit Agent-selection fallback, retained 0, added 0, net -1. Added fallback evidence: none.

The historical T005 ordering deviation remains recorded in Spec 027 and is not being rewritten as satisfied.

[XnLemon]

Resolved by the reviewed Console browser slice and platform PR #65, merged into NeKiro main. Fresh Compose + Chromium production acceptance passed in CI run 30401796416; the operation report is now merged in NeKiro PR #70.