refactor: add React Doctor CI and atomic machine connections

[ksarangmath]

Summary

• Add SHA-pinned React Doctor CI: pull requests block new errors in changed React code, while pushes to main run a non-blocking full audit. React Doctor is pinned to version 0.7.2.
• Refactor the React findings from first principles: remove effect-driven derived state, consolidate resource combobox behavior, preserve stable pagination, query, selection, and streamed-message identity, and add focused serialization and domain tests.
• Replace the multi-request BYO machine setup flow with an atomic POST /api/v1/orgs/{orgID}/machines/connect endpoint that creates the machine, daemon token, and only the selected project grants in one transaction.
• Isolate forms rendered inside portaled dialogs so granting a model, machine, or pool from an agent builder cannot submit the surrounding Create Agent or Create Profile form.
• Pre-bundle the Monaco YAML worker in Vite so first-time editor loading cannot trigger a delayed development-server reload after navigation.
• Upgrade the Go toolchain and SHA-pinned Docker builder to 1.26.6 for the standard-library security fixes required by govulncheck.

Intentional behavior

• Builder model selection is explicit; the first alphabetic grant is not treated as a product default.
• Stale grants remain visible in the draft and are rejected authoritatively by the server instead of being erased by client effects.
• Machine connection is all-or-nothing: a machine, token, and all requested grants are committed together or nothing is created.

Validation

• make verify
• make govulncheck: zero reachable vulnerabilities across the root and tool modules
• Browser E2E: all 5 scenarios pass, including a valid outer Create Agent form that submits a nested grant dialog and asserts zero agent submission requests
• Targeted storage and HTTP integration coverage for atomic creation, rollback, every selected-project authorization, and browser plus organization-manage requirements
• Focused frontend coverage for SDK stream-error identity, checkbox accessibility semantics, and stable-key array pagination
• Cold Vite dependency optimization: monaco-yaml and monaco-yaml/yaml.worker.js are pre-bundled and requesting the worker causes no optimizer reload
• React Doctor 0.7.2 changed-scope audit: 100/100 for @omnara/react and @omnara/web
• Independent Claude review: no blocking defects; all three actionable frontend findings were addressed and the stale description claims were removed

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 8d15258.}

[cmsparks]

lgtm!

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a8e93d6. Configure here.}

[cursor]

Incomplete Monaco Vite preload

Medium Severity

optimizeDeps.include only pre-bundles monaco-yaml/yaml.worker.js, while the lazy-loaded YAML editor still imports monaco-yaml on first open. That main-thread package can still trigger a delayed Vite dependency-optimization reload after navigation, which is the failure mode this change set out to prevent.

 

^{Reviewed by Cursor Bugbot for commit a8e93d6. Configure here.}