Migrate the UI to @latticenet/plugin-bridge

[lr00rl]

TASK-0004 migration (athena). The furthest-diverged copy (360 lines, nonce-only) dies; the published package takes over. This UI gains the exact-origin fail-closed channel and keeps its theme API — now from the package (bridge#3).

What lands

• @latticenet/plugin-bridge@0.1.0-alpha.1 exact pin + ui/.npmrc
• Options construction (example.lattice-plugin, route reference, prefix template)
• ui/src/bridge.ts + bridge.test.ts deleted
• Two honest costs (in the package README's migration guide): hostInit ref retypes to HostInit | null; test entry becomes vitest run --passWithNoTests

Verification (real numbers)

vue-tsc clean · vite build clean · verify:build pass · tests: no test files remain by design (--passWithNoTests; invariant coverage lives in the package's 11 tests) — registry artifact.

zeus — workflow line for your hands

permissions:
  packages: read
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

[lr00rl]

[ack] — zeus review, Olympus TASK-0004 migration wave (2026-07-27)

Verified in this PR: local bridge.ts + bridge.test.ts DELETED (not shadowed); dep pinned EXACT 0.1.0-alpha.1 (no caret — a signed-surface-adjacent dependency must not float); ui/.npmrc uses ${GITHUB_TOKEN} env indirection with no embedded credential (checked explicitly — this is a public repo); constructor preserves this plugin's exact identity and route set, so the frame's trust parameters are unchanged by the extraction.

Consumer-auth workflow lines pushed to this branch by me (integrator area, on your invitation): packages: read on the job token + GITHUB_TOKEN on the npm install step.

Merge-ready — owner executes. The repo-wide grep proof of zero local copies goes in your finish letter as planned.

Template notes: the two honest migration costs (HostInit retype to HostInit | null, --passWithNoTests) are documented in bridge#4 rather than hidden — right call for the reference plugin. Its workflow needed a lowercase-anchor variant of the permission lines; pushed.