fix(ux): wrap showNewRuleModal in try/catch on empty-install banner CTA

QA-review of 7ed8f8a flagged MEDIUM: original CTA handler called
_actions.showNewRuleModal() then removed the banner; if the modal
init throws, banner is gone AND no modal renders — admin loses both
onboarding paths until reload (silent failure).

Fix: try/catch the modal call. On exception, keep the banner visible
and surface UI.showMsg("Could not open the new-rule dialog. Reload
the page to retry.", "error"). On success, remove banner non-stickily
(unchanged behavior).

Verified in browser (Playwright, build 662):
  - Patched Modals.showNewRuleModal to throw; CTA click:
    * exception contained inside try/catch (cta_throw_propagated: false)
    * banner stayed visible (banner_visible_after_click: true)
    * modal did NOT open (modal_open: false)
    * error toast appeared with the exact message text
  - Restored Modals.showNewRuleModal; re-clicked CTA:
    * modal opened (modal_open_happy: true)
    * banner removed (banner_after_happy_click: false)

QA findings dispositions:
  - MEDIUM (deferred-exception in UI handler) → fixed in this commit
  - LOW (analyst-tier verification missing): backend check confirmed
    that ALL non-admin verification paths in this dev container
    return can_create_rules=True because superadmin enabled
    allow_analyst_create_rules — by design. The banner's gate
    `if (!canCreateRules) return;` mirrors the dropdown's
    `if (canCreateRules) { createBtn = ... }` (wl_nav.js:99-106),
    so banner-visibility = create-button-availability. No bypass.
  - OPEN (RELEASE_CHECKLIST.md re-run section): docs/RELEASE_CHECKLIST.md
    §5 "AppInspect Dry-Run" is the existing mechanism — my note in
    docs/APPINSPECT_FINDINGS.md correctly defers to that gate at
    release time.

Bumps build 661 → 662 + urlArgs _b=662 in lockstep (cache-bust
pairing per CLAUDE.md decision-log 2026-04-22).

Author: RelativisticJet

appserver/static/modules/wl_nav.js

@@ -139,13 +139,25 @@ define([
         );
 
         $banner.on("click", ".wl-empty-install-cta", function () {
-            if (_actions && typeof _actions.showNewRuleModal === "function") {
+            if (!_actions || typeof _actions.showNewRuleModal !== "function") {
+                return;
+            }
+            try {
                 _actions.showNewRuleModal();
-                // Hide banner for this session — admin took action. Non-sticky
-                // (no localStorage flag): if the modal is cancelled and state
-                // is still empty, the banner reappears on the next page load.
-                $banner.remove();
+            } catch (e) {
+                // Modal failed to open — keep banner visible so admin can
+                // retry. Without this branch, both onboarding paths would
+                // disappear silently.
+                showMsg(
+                    "Could not open the new-rule dialog. Reload the page to retry.",
+                    "error"
+                );
+                return;
             }
+            // Modal opened — remove banner for this session. Non-sticky
+            // (no localStorage flag): if the modal is cancelled and state
+            // is still empty, the banner reappears on the next page load.
+            $banner.remove();
         });
 
         function dismiss() {

appserver/static/whitelist_manager.js

@@ -11,7 +11,7 @@
 // disk cache. Splunk serves /static/@<server-hash>/... with Cache-Control:
 // public, max-age=31536000; without urlArgs, bumped build numbers don't force
 // a re-fetch and clients run stale JS until they hard-refresh.
-require.config({ urlArgs: "_b=661" });
+require.config({ urlArgs: "_b=662" });
 require([
     "jquery",
     "underscore",

default/app.conf

@@ -5,7 +5,7 @@
 
 [install]
 is_configured = false
-build = 661
+build = 662
 
 [launcher]
 author       = Oleh Bezsonov