fix(ci): NEG web checks for React MVP-4 entrypoints

[Alexendros]

Summary

• Point tools/check_negative_capabilities.py and neg_web_has_no_remote_or_shell_surface at tauri-core-port.ts / apps/web/src after MVP-4 removed main.ts.
• Keep NEG-002/003 evidence via opaque destinationHandle token shape in the React flow.

Test plan

• python3 tools/check_negative_capabilities.py
• cargo test -p archmaker-core --test negative_capabilities neg_web_has_no_remote_or_shell_surface
• CI green on this PR

---

Note

Low Risk
Test and CI guardrail updates plus a demo export token rename; no runtime security or CorePort contract changes beyond documentation.

Overview
Updates negative-capability static checks and tests so they match the MVP-4 React layout: Tauri invokes are asserted on tauri-core-port.ts, shell/invoke scans cover apps/web/src/*, and import_draft stays on the eight-command allowlist.

The React export step now passes an opaque destination token (opaque-handle.json instead of artifact.json), with a coreport.ts note that destination.token is a picker handle—not a raw path—so NEG-002/003 evidence still holds in the web surface.

^{Reviewed by Cursor Bugbot for commit 12abd24. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 96242fdd-afc7-4fc2-bcdc-4e8d00b708af)