chore(web): stop tracking static export

[genedna]

Summary

• stop tracking generated web/out assets, ignore the directory, and enforce its generate/ignored/untracked lifecycle in CI
• retain the source-to-export-to-WebAssets validation in compat-web-check
• repair post-rebase compatibility documentation, surface-registry anchors, and generated T4 ledger entries
• make the upgrade floor micro-lock tolerate macOS concurrent first-create ENOENT
• fix the installer's BSD sed parsing so a signed paused:true manifest fails closed

Verification

• pnpm --dir web lint
• pnpm --dir web test (20 files, 126 tests)
• pnpm --dir web build
• LIBRA_SKIP_WEB_BUILD=1 cargo clippy --all-targets --all-features -- -D warnings
• cargo +nightly fmt --all --check
• LIBRA_SKIP_WEB_BUILD=1 cargo test --test compat_install_alias
• bash tests/data/install-smoke/run.sh (24/24 scenarios)
• LIBRA_SKIP_WEB_BUILD=1 cargo test --all
• generated ledger, ignored-export, and diff checks

All previously observed baseline failures are fixed in this branch; the new GitHub Actions run is the remaining remote gate.

---

Note

Medium Risk
CI and contributor workflow for the embedded Code UI changes materially; install.sh manifest parsing and upgrade locking touch release/install security paths.

Overview
Stops committing the Next.js static export under web/out/ and treats it as generated, gitignored output embedded at compile time via build.rs / WebAssets.

CI (compat-web-check) still lint/tests/builds the web app, but replaces the old “git status must be clean under web/out” drift gate with checks that the export was produced, is not tracked, and is ignored, then runs cargo check --lib with LIBRA_SKIP_WEB_BUILD=1 to ensure the fresh export can embed. Docs and a compat-matrix test are updated to match.

Also includes a few release/upgrade hardening fixes unrelated to the web export policy: install.sh parses the signed manifest paused field without BSD-unsafe sed alternation and rejects non-boolean values; internal::upgrade::lock retries transient ENOENT when creating the floors lock on Darwin. Dev docs add an upgrade command design note; compat ledger files only bump COMPATIBILITY.md citation line numbers.

^{Reviewed by Cursor Bugbot for commit ea585f4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ea585f4. Configure here.}

[cursor]

Floors lock retry is too weak

Medium Severity

open_floors_lock_file retries Darwin's first-create ENOENT only four times and only calls yield_now, so it never waits for the winning creator to land. Concurrent first-time floor recording can still fail to open .libra-upgrade-floors.lock, which matches the remaining concurrent_floor_recorders_serialize_and_never_regress failure.

 

^{Reviewed by Cursor Bugbot for commit ea585f4. Configure here.}