fix(creative): make frontend previews transactional

[bobleer]

Summary

• Replace optimistic Creative frontend activation with a host-owned two-phase preview transaction and exact navigation authorization.
• Start the authoritative 15-second confirmation window only after the real app shell reports readiness, with immutable recovery controls and automatic rollback.
• Keep the confirmed active revision authoritative until commit, persist crash-safe state backups, and make FrontendWorkbench apply return the final confirmed or rolled-back outcome.
• Keep readiness and decision commands local to the visible Desktop surface across remote workspace, remote control, Peer Device, and headless boundaries.

Root cause

The previous main-webview navigation policy accepted only the exact initial URL. Creative activation navigated to a different custom-protocol URL with revision identity, so WebView navigation was rejected even though the navigate call only reported that the request was submitted. State and Agent messaging then treated that request as successful before the new page had rendered.

Validation

• cargo test -p bitfun-desktop --lib frontend_workbench -- --nocapture (18 passed)
• cargo test -p bitfun-core --no-default-features --features agent-runtime,git,tools-creation --lib frontend_workbench_tool -- --nocapture (4 passed)
• cargo test -p bitfun-cli --bin bitfun frontend_update_decisions_stay_on_the_controller_device -- --nocapture (1 passed)
• pnpm --dir src/web-ui exec vitest run src/infrastructure/api/adapters/peer-device-adapter.test.ts (51 passed)
• pnpm run check:web
• pnpm run capabilities:check
• pnpm run check:repo-hygiene
• node --test scripts/frontend-workbench-dev-baseline.test.mjs
• cargo build -p bitfun-desktop

Remote scenarios

Local Desktop is the supported execution surface. Remote workspace, remote mobile or bot control, Peer Device control, and detached or headless execution fail explicitly instead of falling back to a controller-local frontend path.