[UI updates 4/6] Enforce server admission and candidate readiness

[srctl]

Freezes new work while observing existing workers, tracks in-flight activity, and enforces capability-bound maintenance/probe requests before ordinary HTTP or auth work.

Layer 4 of 6 replacing original PR #11. Base: review/ui-updates-03-recovery. Merge in the order below; after each lower PR merges, retarget the next PR to main. If lower layers are squash/rebase merged, reconcile descendant branch ancestry before proceeding; do not merge the original monolithic PR.

Incremental scope: Server/worker/login/computer gates, transactional steering admission, auth readiness, read-only navigation during drain, and corresponding work/gate/auth regression tests. The server entry wrapper is introduced with its gate but without the update API import/dispatch; those three lines arrive with the complete helper in layer 5. This is the only staged production-file edit; all final bytes are restored.

Diff: 18 files changed, 702 insertions(+), 20 deletions(-).

Verification at this cumulative head:

• Typecheck and app/CLI production builds passed.
• Full unit suite: 195 passed, 0 failed. Tests are introduced with their behavior, not deferred to the final PR.
• Checks use the unchanged locked dependencies, Node 24.15.0, pnpm 9.15.0, umask 022, and no inherited Roost binary overrides. Builds use isolated RAM-backed temporary storage. From layer 2, an uncommitted test allocator redirects only the download fixture to RAM storage because staging requires >2 GiB free; actual capacity/extraction/security checks are not mocked. Initial environment-only failures were corrected before the passing runs.
• This restructuring does not requalify intermediate packages for release or deployment. No new VM/native-browser lifecycle run was performed. The final aggregate tree equals original head 57fb9ae27ae602baba28d68e96af817208c89bdd; existing supported-platform evidence and limitations apply only to that complete tree.

Preserved operator guidance, matched screenshots and acceptance records · Full evidence and limits · Recovery boundaries

Stack and merge order:

1. [UI updates 1/6] Validate offers and protect update storage
2. [UI updates 2/6] Stage and verify bounded release artifacts
3. [UI updates 3/6] Journal transactions and recover matching release/data pairs
4. [UI updates 4/6] Enforce server admission and candidate readiness
5. [UI updates 5/6] Connect supervised helper, enrollment, CLI and authenticated API
6. [UI updates 6/6] Add Settings confirmation, reconnect and retained drafts

Original PR #11 cannot be the bounded top layer without changing its head: the new cohesive commits are not ancestors of its preserved head, and GitHub's merge-base comparison would include the original large implementation diff. Its history, review discussion, operator guidance and all 16 verified attachments are preserved. No docs/evidence are recommitted.