feat(mobile): native phone shell instead of a scaled desktop (#329)

[waterbro-8]

Closes #329

What

Phone user agents get a native RoleWeave shell instead of a scaled desktop.

• Organization tab: read-only preview of examples/oss-maintainer
• Command / Desktop / Settings tabs: thumb-first navigation
• /api/mobile/workspace returns names, budgets, and skill excerpts only
• Preview server: PORT=4173 node scripts/mobile-web.mjs

Turns still run on the desktop app. This slice does not hire, edit the org tree, or expose the control-plane token.

Verify

node --test scripts/test/mobile-web.test.mjs

Notes

Desktop browsers keep the existing workbench. Force the phone shell with /?surface=mobile when both surfaces are served.

[waterbro-8]

CI on this PR is green: Node 24 ubuntu/macOS npm run check (includes scripts/test/mobile-web.test.mjs), unsigned installers, unpacked staging smoke, layout parity, CodeQL, dependency review, and Scorecard.

Ready for review. Turns still run on the desktop app; this slice is the phone shell plus the example-org preview.

[wadrzl]

LGTM。CI 全绿，测试覆盖，HTML 做了 escapeHtml 防 XSS，safe-area 和 reduced-motion 都考虑到了。

一个非阻塞的观察：这个 PR（Web Shell）和 #342（原生 Android）是两条技术路线，后续需要明确是否长期并存，避免维护负担。

[waterbro-8]

Web shell (#330) and native Android (#342) stay as two surfaces for now:

• Web shell: ASteam hosted product ($PORT / 我的产品). No install.
• Native apps: Xcode / Android Studio / DevEco clients for people who already run RoleWeave desktop.

They share phone-link.v1 and GET /api/mobile/workspace. They do not share UI code. Native does not replace the hosted web entry until there is a distributable install.

[waterbro-8]

补充修复：/?surface=desktop 现在会退出手机静态资源解析，交由上层桌面工作台处理，不再返回手机 shell。

验证：node --test scripts/test/mobile-web.test.mjs，5/5 通过。当前 head：1893b50186656d3245d3098c13c63446ebede211。

@PeterGuy326 @Bindy-lbb 请在本轮 CI 完成后对最终 head 做独立正式 review。

[sun-970]

Review — Approve

Head 1893b50. Required CI on this head is green (verify Node 24, installers, unpacked smoke, layout parity, CodeQL, dependency review, Scorecard).

Requested fix

/?surface=desktop no longer serves the mobile shell.

resolvePublicAsset("/", { surface: desktop }) returns null, so the mobile preview server does not emit data-surface="mobile". Covered by desktop surface falls through instead of serving the mobile shell in scripts/test/mobile-web.test.mjs. /mobile still serves the phone entry, which is the explicit path.

#329 AC

• Phone / ASteamApp UA → mobile shell (isMobileUserAgent + HTML data-surface="mobile").
• Desktop UA on / does not get the phone shell.
• Org tab is a read-only examples/oss-maintainer snapshot (name, reporting line, budget, skill excerpt). Snapshot JSON does not include host paths.
• Four tabs; tab/button min-height 48px; env(safe-area-inset-*); prefers-reduced-motion.
• Turns stay on the already-open desktop host (phone-link pair + command.submit). No hire / org edit / boot token.
• Org preview HTML goes through escapeHtml.

Non-blocking

• The same CHANGELOG bullet is inserted in three ### Added sections (Unreleased plus two older blocks). Only Unreleased needs it; the extra copies can be cleaned in a follow-up.
• WebSocket close says it will retry but does not reconnect. Pairing still works on the next submit.

Not a CODEOWNER; merge still needs whatever branch protection requires.