refactor(mcp): rebuild Project Status app view as Web Components

[chicoxyzzy]

Summary

Stacked on feat/mcp-apps-ui-extension (PR #80, which now also carries #81's docs/skills/mcp-apps/SKILL.md). Merge that first, or review this against that base.

Before: the Project Status MCP app view was a single TypeScript file that imperatively built the entire DOM, bundled by a hand-rolled Bun.build script into one committed ~356 KB dist/project-status.html. The complaint: too much dynamic JS building DOM inside what is effectively one HTML file — no real structure.

After: the view is native Web Components (custom elements, no framework). A root <project-status-app> owns the ext-apps handshake, per-project state, and dispatch, delegating to <health-section>, <operations-brief-section>, and <activity-section> over a shared BaseComponent. Rendered output is identical to before (same three sections, badges, count grids, inert action pills, activity buckets).

What changed

• Web Components restructure. One component per section + a shared base. Templates are static, data-free structure only; every payload value is written via textContent/attributes — no innerHTML with interpolated data — preserving the injection-safety property the prior review verified. A payload containing <script> or HTML entities renders inert.
• CSP unchanged and strict: default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'. Built HTML has zero eval(, zero external script/style/asset references, inline module script only. Styling via shadow DOM + adopted stylesheets.
• Toolchain mirrors Hecate's ui/: Vite + vite-plugin-singlefile (keeps the single-file embed, matches the official ext-apps templates), bun package manager with a committed frozen lockfile, tsc --noEmit typecheck, oxlint/oxfmt. Deterministic, byte-reproducible build.
• Vitest component tests (happy-dom): 20 tests across the four components — rendering from the golden fixture structuredContent payloads, per-project state reset (no cross-project bleed), and escaping/inertness.
• Dev preview: bun run preview (Vite dev) loads the view outside an MCP host with selectable fixture payloads, for local iteration. Documented in the views README.
• TS everywhere: verify/verify.mjs → verify/verify.ts (run via bun); config files are .ts. No .mjs.

dist/ is no longer committed — with a structural build guard (needs sign-off)

A committed build artifact was flagged as a footgun. This mirrors Hecate's ui/dist convention and adds structural protection so forgetting to build fails hard and immediately at go test time (not just a CI diff):

• internal/app/views/dist/project-status.html is gitignored and built in CI/release; a committed empty dist/.gitkeep + directory embed //go:embed all:views/dist keep the Go build compiling on a clean checkout.
• Structural staleness guard. The Vite build injects <meta name="cairnline-views-src-sha256"> — a deterministic hash over the view source set (src/**, index.html, package.json, bun.lock, vite.config.ts). A Go test (TestProjectStatusView_BundleBuiltAndFresh) recomputes that hash from the working-tree source and fails go test loudly if the embedded bundle is missing ("not built") or its hash doesn't match the current source ("STALE — rebuild"). The source files are embedded into the test binary, so editing any of them busts Go's test cache and the guard re-runs on plain go test — a cached PASS can't mask a stale bundle. The guard is test-only; go build/go install are unaffected.
• Convenience: make views / go generate ./internal/app/ / bun run build refresh the bundle. CI builds the bundle before go test; a separate views job runs typecheck + Vitest.

Trade-off for sign-off: previously a clean go install from a fresh clone produced a fully-working Project Status view (committed bundle). Now go build/go install still compile and run but serve a minimal "view not built" placeholder until bun run build populates dist/, and go test ./... fails loudly until the bundle is built/fresh. Matches Hecate's ui/dist behavior, with an added hard local guard.

Verification

• bun install --frozen-lockfile clean; bun run typecheck clean; bun run test → 20/20; bun run build byte-reproducible (identical sha256 across two frozen rebuilds); oxlint + oxfmt clean.
• go test ./... green with a fresh bundle; the guard demonstrably fails on a missing bundle ("not built") and on an unbuilt src edit ("STALE"), then passes after rebuild. go vet ./... clean; golden JSON fixtures byte-unchanged.
• bun verify/verify.ts headless render: handshake ordered, all sections rendered, no cross-project bleed; screenshot captured.

Docs

Views README + docs/skills/mcp-apps/SKILL.md updated for the new toolchain, preview flow, CSP/injection-safety invariants, and the gitignored-dist + build-guard model.