feat(ui): support consumer source development

[xiaoland]

Summary

• document the consumer-owned, opt-in @inkcre/ui-web source development loop
• make the public source entry compatible with strict consumer TypeScript graphs
• normalize JSON diagnostics across language-service versions
• record Execution 09 evidence and include a patch changeset

Development boundary

The source overlay remains owned by the consumer. Normal development, CI, and releases continue to use the registry/packed package lane as the authority. The opt-in loop does not use link:, file:, or workspace: dependencies and does not mutate the consumer manifest or lockfile.

The corresponding client-web integration is intentionally outside this PR.

Verification

• producer pnpm check: 12 test files / 104 tests, both packed-package contracts, 21 stories / 108 variants
• consumer pnpm check: 11 test files / 40 tests
• source-mode Vitest: 3 test files / 19 tests
• cross-repository source-mode TypeScript graph
• live Vue and SCSS HMR through the consumer
• consumer manifest and lockfile hashes unchanged across source-mode startup and shutdown
• Reproducible workspace check succeeded for the branch commit