feat(harness): agent-drivable dev harness and CI that gates

A coding agent could develop this repo's Go packages and could not
develop the application: every path to running YellowJacket ended in a
blocking GTK window, so 265 bound methods, 46 events, 33 component
directories and 13 stores had exactly one form of verification
available — `tsc --noEmit`.

The unlock is that `wails dev`'s dev server on :34115 serves the real
frontend with the real generated bindings against the same Go backend a
desktop window attaches to, so a plain Chromium under Xvfb gets a fully
functional app. Four test tiers now exist, cheapest first:

- `make ui-test` — 313 Vitest tests in a real browser in ~2 s, no app,
  no backend, no display. Works because `frontend/wailsjs/` is a pure
  passthrough to `window.go`/`window.runtime`, so faking just those two
  globals runs the real bindings and the real store code.
- `make test` — services in-process, asserting on the payload the
  frontend would receive, via a new `events.Emit` wrapper.
- `make dev-headless` + `playwright-cli` — the real app, driven
  interactively, with an event bridge on `window.__yjEvents` and a
  dev-only control surface at `/__test/`.
- `make e2e` — 19 of those flows frozen as Playwright specs.

`events.Emit(ctx, …)` replaces all 35 direct `runtime.EventsEmit` call
sites: wails' `getEvents` `log.Fatalf`s on any context without its
runtime, so those paths could not run under test and a background
worker could take the app down. Four packages had each hand-rolled the
same guard; nine more guarded on `ctx != nil`, which does not help.
`TestNoDirectRuntimeEmits` fails the build on a new one.

Fixtures are generated, not committed (`make testdata`), and seeds are
built by *running the app* — never by hand-writing config and DB rows,
which would be a second description of a valid YJ_HOME.

`.gitea/workflows/ci.yml` is the first workflow here that tests
anything; the other three only package, so `gitea_ci` reported only
packaging jobs and misled anyone asking whether a push was healthy.
Both jobs were prototyped to green in a bare ubuntu:24.04 container
before the YAML was written, which immediately caught `make lint`
linting three configurations that nothing builds: all three passes
omitted `webkit2_41`, so wails resolved webkit2gtk-4.0 — which Arch
still ships and Ubuntu 24.04 dropped.

Operational instructions live in `.pi/skills/yellowjacket-dev/`,
measured discoveries in `.planning/NOTES.md`, and architecture in
`CLAUDE.md` — split by tense, not by topic, because a topical split
gives every new fact two plausible homes. `make skill-check` fails a
commit if the skill cites a make target that does not exist.

.pi/skills/yellowjacket-dev/references/fixtures.md

@@ -0,0 +1,67 @@
+# The fixture library
+
+`test_data/music_library_test/` is **generated, not committed**:
+`make testdata` (~1 s) builds 31 deterministic tracks across MP3, FLAC,
+Ogg Vorbis and WAV. `make testdata-force` rebuilds unconditionally,
+`make testdata-clean` deletes it. `make test` and `make sandbox-seed`
+depend on it, so it is rarely run by hand.
+
+Tests that need it fetch it through `internal/testfixtures` and skip
+themselves when it has not been generated.
+
+## Select by case, never by path
+
+```go
+m := testfixtures.Load(t)
+paths := m.Case(t, testfixtures.CaseCoverDedup)
+track := m.Track(t, rel)
+```
+
+Cases: `cover-dedup`, `multi-disc`, `various-artists`, `flac-album`,
+`ogg-album`, `wav-tracks`, `partial-tags`, `unicode`, `duplicates`,
+`edge-lengths`, `broken`.
+
+Two invariants worth not breaking:
+
+- **The clean library is exactly 31 tracks**, because `sandbox-seed`
+  verifies the scan against that count. Deliberately malformed files
+  live in a *sibling* root, `test_data/music_library_broken/`
+  (`m.BrokenPath()`), so the scanner never sees them.
+- **Tags are written by `backend/tagwriter`, not by ffmpeg** (which
+  encodes with `-map_metadata -1`). Fixture and reader therefore cannot
+  drift into agreeing with each other and disagreeing with reality.
+
+The manifest (`test_data/music_library_test.manifest.json`, outside the
+scanned root) hashes the *spec* — paths, formats, durations, tags,
+cover identity — not the bytes, because ffmpeg stamps encoder version
+strings and identical specs produce different bytes on different builds.
+
+## In e2e specs
+
+- **Every fixture except one is 2–6 seconds.** A spec that starts
+  playback and then clicks pause races the track ending and fails
+  against a correct UI. Use `LONG_TRACK` (90 s, `edge-lengths`) exported
+  from `e2e/support/fixtures.ts`.
+- **WAV tracks scan in untitled.** `backend/tagwriter` writes WAV tags
+  into a RIFF `id3 ` chunk and `dhowden/tag` has no RIFF parser, so
+  there is no "Field Recordings" artist in the Artists view. This is a
+  known open bug pinned by `TestWAVTagsAreNotReadableYet`; do not
+  "fix" a spec by asserting the broken behaviour elsewhere.
+
+## Seeds
+
+```bash
+make sandbox-seed NAME=default   # build (boots a fresh YJ_HOME and drives the app)
+make sandbox-seeds               # list
+make dev-headless SEED=default   # restore into a run
+```
+
+A seed is a tarred `YJ_HOME` produced by *running the app*: fresh home →
+real `AddLibrary` binding → poll until the real scan reports the
+manifest's track count → SIGTERM so shutdown hooks persist state → tar.
+Never hand-write one. Seeding points `YJ_CORE_INDEX_URL` at a dead
+address on purpose, so no seed depends on what the explore artifact
+server happened to be serving.
+
+Rebuild a seed after any schema change, or the restored database is
+migrated on open in a way the seed's author never saw.