fix(web): align story creation permission and verify workspace lifecycle

[shuntianyifang]

The Stories page checks the retired runs:execute permission before offering story creation, while the workspace API requires workspaces:execute. A role with workspace execution permission can create a story through the API but cannot start one from the page; a role with only the old permission is offered an action the API rejects.

This change aligns the page with the API and adds browser regression coverage for the persistent workspace lifecycle. Refs #284; this is a bounded UI acceptance contribution, not completion of the release-readiness issue.

Changes

• Check workspaces:execute when rendering story creation, with six permission regression cases covering the exact permission, wildcards, read-only permissions, and the retired permission.
• Add four Chromium tests against the real Next app and a loopback HTTP fixture: creation, suspend/continue, archive/restore, retained history, read-only controls, deletion confirmation/cancellation, visible errors and retry, and no restore after deletion.
• Add one Chromium test using the real API, session authorization, PostgreSQL and FakeWorkspaceRuntime. It verifies the same workspace and untracked file/Claude/Codex session-marker contents survive lifecycle operations, then verifies confirmed deletion removes the files while retaining conversation history.
• Run both browser suites in CI after pnpm verify; document the setup and fixture boundaries. Keep Playwright files outside Vitest discovery.

Latest acceptance

Merged main c14bc6d; the PR head is now daa177de4b6a919cc2e6e05818311d7f4ee5bb85. Ubuntu acceptance run 34309420909 explicitly checks out that exact source tree, without the auxiliary validation workflow in the tested checkout.

• Frozen install, Terraform fmt/init/validate/test, and migration compatibility passed.
• pnpm verify passed its lint, type checks, clean builds, critical integration suites, remaining tests, unused checks and guards, but failed the final dependency audit: 18 findings, including 2 critical and 6 high (2 already ignored by repository policy). No exclusions were added. The affected existing versions, including Next.js 16.2.11, are unchanged by this PR. The full verify job is not green.
• Chromium: 4 UI tests passed (30.5s), plus 1 real API/PostgreSQL/filesystem browser test passed (26.9s). The auxiliary workflow collected this evidence after audit failure while preserving the failed job result.
• Node 22.13.0 compatibility job passed.
• Original Compose and Vercel runner image builds passed. Container smoke checks passed with FACILITY_PREVIEW_URL=https://preview.example.test: migrations exit 0, API readiness, login page, unauthenticated /v1/me rejection, and API/Web restart recovery. Disposable containers and volumes were removed afterward. This does not validate external TLS or preview traffic.
• Direct Edge browser interaction now passed against the real local Next app and disposable loopback fixture: create, suspend, send/resume, archive, reload, restore, deletion confirmation/cancellation, injected failure and retry, retained history/no restore after deletion, and read-only controls. This was a step-by-step browser-control pass, in addition to the automated suites.

Remaining blockers and boundaries

• Dependency audit must be resolved before claiming full acceptance. Previously passing audit results are historical and do not supersede the current failure.
• Default Compose startup fails production validation because its preview URL is HTTP. This was reproduced in run 34307866659; existing fix(config): boot the single-host bundle on loopback origins #333 addresses it. The configured smoke pass above does not claim the default configuration works.
• Upstream PR CI and independent review have no results at the time of this update; keep this PR in draft.
• These fixtures do not prove real hosted engine resume, compute replacement, backup recovery or the 14-day retention/pilot work in [0.12] Prove migration, retention, and release readiness #284. Docker-backed workspace E2E remains a policy-allowed skip for this PR's paths.

Scope and compatibility

This is a user-visible permission-alignment fix, classified as fix(web) (patch, no breaking change). Server-side authorization is unchanged. No migrations, persistence format, budget/cost enforcement or production observability behavior changes.

External catalog/manifest reads and execution use deterministic fakes; tests need no live credentials or network after dependencies and Chromium are installed. The real-API fixture binds to loopback and refuses databases other than local facility_test/facility_ws.

Checked existing PRs on 2026-09-08: #332 covers axe checks on rendered fragments, #337/#339 cover accessibility semantics, and #324 covers Docker wake readiness. Those do not supply this lifecycle browser suite or the story-creation permission fix.