feat(newos4): re-enable the six UI modes behind an opt-in gate (v4.6.162)

The six interface modes (v4.6.152–156) were removed from the startup path outright in
v4.6.157 after crash reports. The crash was never reproduced: F2 in the rollback plan
(2026-11-09_224409) drove all six modes on one page in headless Chromium at 390×844 and
recorded crashes: [], pageerrors: [], heap flat at 10 MB over a 25 s idle. The two
defects the investigation DID find were fixed instead — F3 (nginx 413 on a >1 MB agent
context) and F4 (36 tool handlers where a model-supplied non-string reached
.trim/.split/.replace). v4.6.159–161 also removed the last navigator.onLine verdicts,
which is what made "it died mid-session" look like a UI crash.

So the modes come back, but only for a visitor who asks for them.

1. The gate (modules/core/terminal.js, plan Task 9)
   - Registration is now conditional:
         const _uiExp = ... URLSearchParams(location.search).get('ui') === '1'
                        || localStorage.getItem('webx11_ui_experimental') === '1';
         if (_uiExp) this._safeRegister('UIShellModule', 'UI shell');
   - Without the flag nothing changes: the shell is not registered, no mode can mount (the
     ui-*.js files all begin `if (!terminal.uiShell) return;`), no first-run picker
     appears, `data-ui-mode` is absent and `webx11.uiShell` is undefined.
   - The gate is in the bundle, so it cannot be bypassed by a stale cached ext file.

2. What was verified on the served page (v4.6.162, live Chromium)
   - Classic, no flag: NEWOS4_VERSION v4.6.162, 48 modules, uiShell undefined, 0 #ui-root,
     no #wx11-ui-picker, no data-ui-mode, terminal visible, `help` renders 18,124 chars,
     0 console warnings, 0 JS errors, 55 console messages.
   - Opt-in `?ui=1`: uiShell object, #ui-root + #ui-foot, data-ui-mode="classic",
     49 modules, picker present (opt-in only), 0 warnings, 0 JS errors.
   - All six modes driven through uiShell.apply() with a 1.2 s settle each, and back to
     classic: chat (body wx11-ui-chat, 6 mode nodes), cockpit (3), easy (4), commander (4),
     studio (3), workspace (5), classic (0). #terminal-container survived every switch,
     zero throws, heap 6.3 MB against 3.3 MB classic.
   - Served bytes identical to disk for core-bundle.js; `_uiExp` appears twice in the
     served bundle and the registration line is the guarded one (core-bundle.js:4111).

3. Not done, deliberately (plan Task 9 step 4)
   - `webx11_ui_experimental` is NOT defaulted on for new visitors. The plan asks for one
     week of clean use first, with the crash matrix re-run on the then-current bundle.

Guard for this gate: admin/scripts/verify-newos4-ui-gate.py, wired above `exit $FAIL` in
smoke-auth.sh — a bare (unconditional) registration is the failure it exists to catch.

0 files changed, 0 insertions, 0 deletions