feat(harness): agent-drivable dev harness and CI that gates

A coding agent could develop this repo's Go packages and could not
develop the application: every path to running YellowJacket ended in a
blocking GTK window, so 265 bound methods, 46 events, 33 component
directories and 13 stores had exactly one form of verification
available — `tsc --noEmit`.

The unlock is that `wails dev`'s dev server on :34115 serves the real
frontend with the real generated bindings against the same Go backend a
desktop window attaches to, so a plain Chromium under Xvfb gets a fully
functional app. Four test tiers now exist, cheapest first:

- `make ui-test` — 313 Vitest tests in a real browser in ~2 s, no app,
  no backend, no display. Works because `frontend/wailsjs/` is a pure
  passthrough to `window.go`/`window.runtime`, so faking just those two
  globals runs the real bindings and the real store code.
- `make test` — services in-process, asserting on the payload the
  frontend would receive, via a new `events.Emit` wrapper.
- `make dev-headless` + `playwright-cli` — the real app, driven
  interactively, with an event bridge on `window.__yjEvents` and a
  dev-only control surface at `/__test/`.
- `make e2e` — 19 of those flows frozen as Playwright specs.

`events.Emit(ctx, …)` replaces all 35 direct `runtime.EventsEmit` call
sites: wails' `getEvents` `log.Fatalf`s on any context without its
runtime, so those paths could not run under test and a background
worker could take the app down. Four packages had each hand-rolled the
same guard; nine more guarded on `ctx != nil`, which does not help.
`TestNoDirectRuntimeEmits` fails the build on a new one.

Fixtures are generated, not committed (`make testdata`), and seeds are
built by *running the app* — never by hand-writing config and DB rows,
which would be a second description of a valid YJ_HOME.

`.gitea/workflows/ci.yml` is the first workflow here that tests
anything; the other three only package, so `gitea_ci` reported only
packaging jobs and misled anyone asking whether a push was healthy.
Both jobs were prototyped to green in a bare ubuntu:24.04 container
before the YAML was written, which immediately caught `make lint`
linting three configurations that nothing builds: all three passes
omitted `webkit2_41`, so wails resolved webkit2gtk-4.0 — which Arch
still ships and Ubuntu 24.04 dropped.

Operational instructions live in `.pi/skills/yellowjacket-dev/`,
measured discoveries in `.planning/NOTES.md`, and architecture in
`CLAUDE.md` — split by tense, not by topic, because a topical split
gives every new fact two plausible homes. `make skill-check` fails a
commit if the skill cites a make target that does not exist.

scripts/dev-stop.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+#
+# Stop the headless app started by scripts/dev-headless.sh.
+#
+# Kills the saved process group, never `pkill -f`: a pkill pattern that
+# appears in the invoking compound command's own command line matches
+# the invoking shell, kills it, and silently drops everything after it.
+#
+# SIGTERM first, so OnBeforeClose / OnShutdown run and player and queue
+# state are persisted — a seed built from an SIGKILLed app is a seed
+# missing exactly the state those hooks write.
+#
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+PID_FILE=".dev/app.pid"
+GRACE=10
+
+if [ ! -f "$PID_FILE" ]; then
+	echo "dev-stop: nothing running (no $PID_FILE)"
+	exit 0
+fi
+
+PID="$(cat "$PID_FILE")"
+
+if ! kill -0 "$PID" 2>/dev/null; then
+	echo "dev-stop: pid $PID already gone"
+	rm -f "$PID_FILE"
+	exit 0
+fi
+
+# setsid made the app a process group leader, so -PID reaches the app,
+# xvfb-run and the private dbus-daemon together.
+kill -TERM -- "-$PID" 2>/dev/null || kill -TERM "$PID"
+
+deadline=$((SECONDS + GRACE))
+while kill -0 "$PID" 2>/dev/null; do
+	if [ "$SECONDS" -ge "$deadline" ]; then
+		echo "dev-stop: pid $PID ignored SIGTERM after ${GRACE}s, killing"
+		kill -KILL -- "-$PID" 2>/dev/null || kill -KILL "$PID"
+		break
+	fi
+
+	sleep 0.2
+done
+
+rm -f "$PID_FILE"
+echo "dev-stop: stopped $PID"