feat: publish canonical browser workspace snapshots

Author: lightsofapollo

.beads/export-state.json

@@ -1 +1 @@
-{"last_dolt_commit":"ml7hbt6v78qu7mbghhib3naqa4mr5kmc","timestamp":"2026-07-10T22:24:49.756387-06:00","issues":293,"memories":13}
+{"last_dolt_commit":"nd70mk2dulg4gmq4nkf13n2fated9fvt","timestamp":"2026-07-10T23:49:35.507173-06:00","issues":293,"memories":13}

.beads/interactions.jsonl

@@ -292,3 +292,6 @@
 {"id":"int-1bf9e0a4","kind":"field_change","created_at":"2026-07-11T03:52:33.189517Z","actor":"James Lal","issue_id":"attn-7xl.4.2","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}
 {"id":"int-dce0fd08","kind":"field_change","created_at":"2026-07-11T03:56:05.449875Z","actor":"James Lal","issue_id":"attn-7xl.4.2","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Room ownership + wrapped invite capability persistence landed (browser-workspace-share.ts, BrowserStorage.shares): bindShare seals the raw invite capability (room secret + owner signing/encryption secrets + device/participant ids + policy snapshot + published-revision pointer) under the workspace key via sealCapability (2.2), with AAD binding workspaceId/capId/roomId/scope so a record can't transplant between workspaces or rooms; metadata (roomId, scope, relayUrl, publication state) stays plaintext for UI. Idempotent by capId (same room = no-op resume, different room = conflict, ConstraintError race returns the winner); setPublication (pending/published/stopped) for 4.3/4.5; listShares/forgetShare for stop-sharing + rollback. Validation: 5 cases incl seal/open round-trip across reload, workspace-key binding (crypto-erasure leaves the cap permanently opaque under a fresh key), idempotency/conflict, publication lifecycle, input validation. 57 unit files, svelte-check 0, bundle gate green."}}
 {"id":"int-33119cd4","kind":"field_change","created_at":"2026-07-11T04:02:40.411082Z","actor":"James Lal","issue_id":"attn-7xl.4.3","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}
+{"id":"int-7721b834","kind":"field_change","created_at":"2026-07-11T05:14:47.050535Z","actor":"James Lal","issue_id":"attn-7xl.4.3.1","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}
+{"id":"int-ca79abb8","kind":"field_change","created_at":"2026-07-11T05:49:35.975951Z","actor":"James Lal","issue_id":"attn-7xl.4.3.1","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Canonical workspace manifest/assets and exact Rust/WASM anchor protocol implemented, interoperably validated, crash-safe, and security-reviewed."}}
+{"id":"int-c6567670","kind":"field_change","created_at":"2026-07-11T05:49:45.62616Z","actor":"James Lal","issue_id":"attn-7xl.4.3","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Encrypted workspace snapshots are canonical, resumable, ACK-gated, content-blind, and proven across native/browser protocol implementations."}}