test(newos4): dev tree + crash matrix for the UI modes (prod stays classic)

Follow-up to 11a8e73, which took the UI shell off the production startup path
after the operator's crash report. This commit ships the verification harness the
re-enable is gated on, and nothing that changes what users load.

- admin/scripts/probe-ui-crash.py (new): drives classic -> easy/chat/studio/
  workspace/commander/cockpit -> classic on ONE page per viewport, listening for
  the renderer `crash` event and `pageerror`, asserting exactly one
  #terminal-container, a visible output pane, a docked #status-bar, no horizontal
  overflow, heap < 250 MB and < 20 % drift across a 25 s idle soak in the two
  heaviest modes. Two mobile UAs (Android WebView - the operator's own, no `wv)`
  token - and iOS 16 Safari) get a boot-only pass. rc=1 on any finding.
- admin/docs/ui-crash-matrix-2026-11-09.json: the run of record. 3 viewports
  (390x844, 360x740, 1280x800) x 7 states + 2 UAs = 0 findings, crashes [],
  pageerrors [], heap 9.5 MB in every cell including both idle soaks. The first
  version rounded heap to whole MB (every cell read "10"), which would have hidden
  a 5 MB leak; it now reports one decimal and the committed JSON is the re-run.
- spaces/newos4/.gitignore: `dev/` - the dev tree is served at
  /spaces/newos4/dev/main.html and must never reach the public mirror, which
  publishes git HEAD only (git status --porcelain spaces/newos4/dev = 0 files).

The dev tree itself (24 MB rsync, data/ and all credential files excluded) is not
committed on purpose; its rebuild-bundles.py ROOT is repointed at the dev copy so
a dev rebuild cannot touch the production bundle (verified: prod bundle has 0 hits
for the dev-only `_uiExp` gate).

Not fixed here: the 1 MB nginx body cap on /ai/ and /ollama/ (413 measured on a
1,063,595-byte agent context) - that edit needs sudo approval and is still live.
Plan: .hermes/plans/2026-11-09_224409-newos4-ui-rollback-dev-verify.md

0 files changed, 0 insertions, 0 deletions