feat(canvas): add canonical causal document host

[developer-1px]

Summary

• add a guarded DesignDocument patch port with frozen canonical reads, graph/canonical validation, owned publications, synchronous ownership sequences, and no-op/history safety
• add an EditorEngine ready host that defers during previews, serializes ready work from preflight, and fails closed on reentry or disposal
• dogfood the SHA-pinned json-document causal/stable-id labs in headless integration tests without adding production runtime dependencies
• record scope and follow-up policy in ADR 0006

Scope

This proves the headless DesignDocument to EditorEngine coordination seam. It does not claim React render-settle, IME/composition completion, DOM caret restoration, transport convergence, or CRDT behavior. Remote patch history still uses the local DesignDocument undo stack and remains a production-promotion policy decision.

Validation

• pnpm run release:check (294 release-gate tests plus package build/smoke and app build)
• causal patch/host/integration regressions: 24 passed
• pnpm test:e2e: 124 passed
• lint plus app/package TypeScript checks
• frozen install and four vendored SHA256 checks
• three independent adversarial reviews with no remaining merge blocker

Known baseline: the unrestricted full Vitest suite still has the pre-existing CanvasDemoDesignSystem spacing-token failure for FigmaCloneApp.css margin: -1px; that file is byte-identical to origin/main and is outside this PR.