fix(canvas): isolate remote changes from local history

[developer-1px]

Summary

• advance a conservative local history barrier after each concrete external DesignDocument patch
• clear pre-remote undo and redo before canonical document and patch observers run
• keep failed, deferred, conflicting, test-only, and net-no-op causal work from advancing the barrier
• document the fail-closed policy and selective-undo follow-up in ADR 0006

Behavior

Local A → Remote B → Local C → undo now returns to Remote B. A second undo is unavailable, while redo restores Local C. Remote B itself and stale pre-remote history are not locally undoable.

The policy remains host-owned at the existing Canvas publication seam. No json-document public interface, causal inbox interface, package dependency, or public Canvas surface changes.

Validation

• TDD regression failed before the barrier and passes after it
• focused causal/design-document/host tests: 25 passed
• focused architecture suite: 69 passed
• pnpm run release:check: 294 passed plus package smoke and app/package builds
• pnpm test:e2e: 124 passed
• lint and app/package TypeScript checks
• three independent history/contract/causal reviews with no merge blocker

Known baseline: the unrestricted full Vitest suite still has the pre-existing CanvasDemoDesignSystem spacing-token failure for FigmaCloneApp.css margin: -1px; that file is unchanged by this PR and identical to origin/main.