feat: adopt flow engine for default feedback

[neonwatty]

Summary

• compile the built-in default journey through the shared FlowConfig V1 validator/compiler and FlowRuntime
• preserve the existing legacy UI, capture, submission, focus, accessibility, concurrency, and payload ports
• retain a compile-time-only fixed implementation as an authenticated rollback path
• make rollback self-contained with three exact, digest-pinned baseline source snapshots; no Git history is required at build time

Proof

• paired fixed/flow compatibility: 23/23 with exact normalized traces and request payloads
• release-mode production: 5/5
• full E2E: 317/317
• validation: 1,418/1,418; focused engine suite: 147/147
• release: 449; workflow: 193 plus contract; static: 26
• explicit fixed bundle remains byte-identical to the pre-adoption baseline: 43eed5cd5134d802b675bbf8a5b28b4fff85224bfdd5a649dbf7ff31b6e6ece7
• Git-less controller/candidate regression proves zero Git invocation and candidate-owned dependency resolution
• rollback build: BUGDROP_DEFAULT_FLOW_RUNTIME=fixed npm run build:widget

Safety

No public or production runtime selector is exposed. Manifest/path/length/digest corruption fails closed. The immutable v1.56.0 artifact remains the external rollback boundary.

Review

The required PR review toolkit found and independently validated one blocking rollback defect in the first head (shallow controller Git-history dependency). It was fixed with self-contained authenticated snapshots. Corrected-head focused correctness, tests, contracts, and silent-failure re-review found no high-confidence issues. The native Codex baseline could not rerun on the corrected head because the local Codex review quota was exhausted; this limitation is recorded explicitly.