[bgf] Integrate hardening and smoke proof

[debuggerone]

Summary

• integrates BGF-01 browser regression fixture and Chrome GPU-service failure contract
• integrates deploy secret/certbot hardening so Certbot outages cannot leave production without runtime secrets
• integrates BGF-05 compositor warmup safety proof and source-visible segmentation-unavailable behavior
• integrates BGF-06 safe runtime diagnostics for backend init, unavailable transition, modal choice, and matte rejection
• integrates BGF-07 production smoke/prod-debug proof support for KingRT domains, background assets, and Whiteboard CSP
• checks completed BGF-01, BGF-05, and BGF-06 boxes in SPRINT.md; BGF-07 remains open for real browser call smoke

Validation on integrated branch

• bash -n demo/video-chat/scripts/deploy.sh
• bash -n demo/video-chat/scripts/check-deploy-idempotency.sh
• node demo/video-chat/frontend-vue/tests/contract/deploy-secret-certbot-hardening-contract.mjs
• node tests/contract/background-compositor-warmup-safety-contract.mjs
• npm run test:contract:background-filter
• npm run test:contract:background-aspect
• node tests/contract/background-regression-matrix-contract.mjs
• node tests/contract/background-runtime-diagnostics-contract.mjs
• node tests/contract/client-diagnostics-contract.mjs
• demo/video-chat/scripts/check-deploy-idempotency.sh
• bash -n demo/video-chat/scripts/prod-debug.sh
• bash -n demo/video-chat/scripts/deploy-smoke.sh
• node tests/contract/prod-debug-observability-contract.mjs
• VIDEOCHAT_PROD_DEBUG_DRY_RUN=1 VIDEOCHAT_PROD_DEBUG_SKIP_REMOTE=1 demo/video-chat/scripts/prod-debug.sh
• VIDEOCHAT_DEPLOY_DOMAIN=kingrt.com VIDEOCHAT_DEPLOY_SMOKE_SKIP_REMOTE=1 VIDEOCHAT_DEPLOY_SMOKE_SKIP_ADMIN=1 demo/video-chat/scripts/deploy-smoke.sh
• npm ci && npm run build
• git diff --check

Branch policy

No online branch in this PR uses the codex/ prefix.