Fix hosted feedback consent, optional email and focus parity

[sarthakagrawal927]

Summary

Replace the obsolete npm feedback mount with a native lazy trigger and the official shared hosted feedback form. Preserve the public catalog key resolver and existing focused/public-share route guards. Remove the unused legacy dependency.

The maintained shared form provides optional email, initially unchecked required consent, privacy link, focus trapping, Escape, and return to the native Feedback trigger. The adapter deduplicates pending loads, times out after eight seconds, offers truthful retry, and ignores obsolete callbacks. Feedback page URL excludes queries and fragments.

Verification

• Full quality gate and 991 tests pass at the rendered candidate e91fc36 in run 37192953403; the final receipt commit has a fresh CI run pending.
• Complete CI-built static app rendered locally in guest mode; actual hosted SDK loaded normally. Captures at 390/768/1440px: one dialog, required consent, optional email, no horizontal overflow, 44px trigger, correct focus restoration.
• Actual focused study route and public shared roadmap show zero Feedback triggers.
• design-workflow check passes for the fresh preserved-direction receipt. Actual iteration/final slop reports retained; advisory findings preserve existing Geist/dark workbench/path grouping.
• Added CI-only one-day static artifact retention with read-only permissions; excludes large WASM files. No runtime dependency or production config added.

Limits

Both Cloudflare preview URLs fail TLS in Chrome. Local full-app static rendering proves the candidate UI, not backend availability or production release. Backend requests returned explicit 503 during local qualification; no QA submission was made. Production release and live browser verification remain required. Screenshots and raw reports are private retained evidence. Owner acceptance is not inferred.

Tracks #122. Keep the issue open until the release is independently verified.

[sarthakagrawal927]

CI findings and follow-up

CI run37191041385 at a9e2fbc passed formatting, lint and TypeScript, then ran 991 tests: 987 passed, four new loader fixtures failed. Logs show Happy DOM immediately raises an external-script-disabled error on insertion, so the script is removed before the synthetic event. The fixture now retains an inert script node and explicitly controls load/error timing; the production loader is unchanged.

Independent Luna review also found full-page URLs were forwarded. Follow-up strips query/fragment and adds a regression assertion. Local follow-up commits: df69e8e and 9e6fd08. These are not yet pushed: the normal pre-push lint hook now fails because the installed Darwin Biome binary is missing. No hook or security check has been bypassed. Managed frozen repair is in progress; actual rendered and release qualification remain pending.