chore: checkpoint web Blender migration source, tools and docs

Accumulated uncommitted work: GHOST Web backend, WebGL/GPU web layer,
web workflow engine and protocol, tooling, docs and task records.
Large generated evidence, user-testing archives, build snapshots and
imported test assets remain untracked.

Co-Authored-By: Claude Code <noreply@anthropic.com>

web/tests/fixtures/workflow-case-setup.ts

@@ -0,0 +1,23 @@
+import assert from 'node:assert/strict';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import type { FullConfig } from '@playwright/test';
+export default async function setup(config: FullConfig) {
+  const origin = config.projects[0].use.baseURL; assert.equal(typeof origin, 'string');
+  const candidate = JSON.parse(fs.readFileSync(path.join(process.env.WEB_DESKTOP_CANDIDATE_PUBLIC!, '../candidate.json'), 'utf8'));
+  const observed = [];
+  for (const name of ['web_engine.js', 'web_engine.wasm']) {
+    const response = await fetch(`${origin}/vendor/blender/${name}`, { signal: AbortSignal.timeout(60000) });
+    assert.equal(response.status, 200, `serve ${name}`);
+    assert.equal(typeof response.headers.get('cross-origin-opener-policy'), 'string');
+    assert.equal(response.headers.get('cross-origin-opener-policy'), 'same-origin');
+    assert.equal(typeof response.headers.get('cross-origin-embedder-policy'), 'string');
+    assert.equal(response.headers.get('cross-origin-embedder-policy'), 'require-corp');
+    const bytes = await response.arrayBuffer(); assert.ok(bytes instanceof ArrayBuffer);
+    const sha256 = crypto.createHash('sha256').update(new Uint8Array(bytes)).digest('hex');
+    assert.equal(typeof candidate.sha256[name], 'string'); assert.equal(sha256, candidate.sha256[name], `served ${name} drift`);
+    observed.push({ name, bytes: bytes.byteLength, sha256 });
+  }
+  fs.writeFileSync(path.join(process.env.WBV2_CASE_ATTEMPT!, 'http-prerequisites.json'), JSON.stringify({ origin, observed }, null, 2));
+}