ci: enforce committed Linux visual baselines - #508

## Summary

Adds the source-only React Native platform: shared tokens/contracts,
core package, 171 Native modules, an Expo Android/iOS catalog, and
platform-aware EN/FR registry discovery, installation, SEO, MCP and LLM
surfaces. Stable Web installation remains `@vllnt/ui@^0.3.0`; Native
installation remains unavailable/experimental.

Checkpoint `1963f57` includes the accumulated reviewed component
repairs, colocated/shared regression organization, registry fixes,
package-boundary tests and 0.4.0 canary guards. Merge `f7ed137`
incorporates main `705fb7b`, retaining Native tooling and regenerating
the lockfile with the Turbo security upgrade (resolved 2.10.12). No
reviewed dirty work was omitted.

Follow-up `ccdb7d0` resolves fresh CI React Doctor findings: Toast
effects own cleanup while preserving original expiry deadlines across
rerenders; keyed fragments isolate StepByStep list identity from
forwarded props. Full Native tests and CI-pinned React Doctor 0.5.8 pass
(zero errors, 104 advisory warnings).

## Validation — HEAD `ccdb7d0`

Node 22.23.2 / Corepack pnpm 9.15.4, macOS:

- Web lint and build-project TypeScript: passed.
- `pnpm build` and `pnpm test:once`: passed; tests 6/6 workspace tasks,
zero cached; Web 318 files / 1678 tests.
- `pnpm ci:native`: passed, including 34 suites / 225 tests, package
checks, Expo Doctor and Android/iOS Metro exports.
- Registry lint/types, `i18n:check`, `registry:integrity`,
`registry:check`: passed; EN/FR parity, 313 items, stable install target
^0.3.0.
- `node --test scripts/release-guard.test.mjs
packages/ui-native/scripts/check-boundaries.test.mjs`: 6/6 passed (5
release + 1 boundary).
- Frozen lockfile install and whitespace checks passed.
- Normal hooks completed without bypass. The host's unpinned hook
reports an incomplete analysis/Toast diagnostic; the explicit CI-pinned
`pnpm dlx react-doctor@0.5.8 . --diff origin/main --offline --fail-on
error` passes with zero errors. Fresh remote checks remain required.
- The combined gate command reached its 200-second wall-clock limit at
the final catalog export; rerunning that remaining catalog build and
registry/release checks completed successfully. All preceding Native
pipeline steps passed.
- Isolated paired tarballs `0.4.0-canary.66.shaccdb7d0`: exact archive
versions/Native→core dependency/dist entries asserted; offline
installation, strict consumer TypeScript, core runtime/JSON subpaths and
Android/iOS Metro resolution with exports enabled/disabled passed.
Packages resolve inside isolated node_modules, not workspace sources. An
exact-version-only pnpm override transports the unpublished core
tarball; it cannot match a different version, and archive dependency
equality is independently asserted. This is resolution/type proof, not a
packed Native device render or full packed Metro transform.

## UI evidence and limitations

Historical Task61 strict independent main-baseline comparison: 305/305
passed with PR snapshot updates disabled; full E2E 78 passed / 7
live-Storybook skips. This evidence covers the reviewed source tree
before release/version and merge changes, not a new final-HEAD run. No
head snapshots were updated. Physical iOS/Android, VoiceOver/TalkBack,
minimum-runtime matrix and residual contract/design findings remain
explicitly documented in `docs/PR506_*REVIEW*.md`; source inspection of
171 modules is not production certification. PR #508's durable Linux
baseline work is not incorporated or claimed complete.

## Merge authorization and checks

The user explicitly authorizes conflict resolution and squash merge,
accepting **only `ntk / preview` failure** for now. This supersedes
historical reports' no-merge/draft language; this PR remains ready, not
converted to draft. All final-head non-preview remote checks passed:
Quality, Native, E2E, React Doctor, both CodeQL analyses, issue link,
Storybook build/tests/coverage and visual job. CI:
https://github.com/vllnt/ui/actions/runs/34230240495 ; Storybook:
https://github.com/vllnt/ui/actions/runs/34230240491 ; health:
https://github.com/vllnt/ui/actions/runs/34230240475 . The visual job's
existing snapshot-update behavior is not claimed as strict regression
proof. Only `ntk / preview` failed. Normal head-fenced squash merge is
authorized. No admin override, branch-protection changes, force push,
hook bypass or approval bypass is authorized.

## Release boundaries

Merge may trigger existing main CI/Web canary automation. Checked-in
guards restrict 0.4.0 to canary and reject stable promotion; Native/core
versions match 0.4.0, exact paired prerelease dependencies and
staging/canary tags are retained. Native's enable-variable/environment
gate is unchanged; no credentials or enablement settings are changed. No
manual publication, deployment, stable promotion or workflow dispatch is
performed. Device/AT and publication-recovery verification remain
required before advertising Native installation.

Related to #479