chore: checkpoint web Blender migration source, tools and docs

Accumulated uncommitted work: GHOST Web backend, WebGL/GPU web layer,
web workflow engine and protocol, tooling, docs and task records.
Large generated evidence, user-testing archives, build snapshots and
imported test assets remain untracked.

Co-Authored-By: Claude Code <noreply@anthropic.com>

web/tests/unit/web-engine-runtime-sync.test.mjs

@@ -0,0 +1,40 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { syncWebEngineRuntime } from "../../../tools/web/sync-web-engine-runtime.mjs";
+
+function fixture(t) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "webengine-sync-"));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  fs.mkdirSync(path.join(root, "build_web_blender6/bin"), { recursive: true });
+  fs.mkdirSync(path.join(root, "web/app/public"), { recursive: true });
+  const wasm = Buffer.from([0, 97, 115, 109, 1, 0, 0, 0]);
+  fs.writeFileSync(path.join(root, "build_web_blender6/bin/web_engine.wasm"), wasm);
+  fs.writeFileSync(path.join(root, "build_web_blender6/bin/web_engine.js"), "export default {};\n");
+  const manifest = { modules: [{ resources: { single: { url: "/vendor/blender/web_engine.wasm", sha256: "old" }, pthread: { url: "/vendor/blender/pthread/web_engine.wasm", sha256: "other" } } }] };
+  fs.writeFileSync(path.join(root, "web/app/public/wasm-module-manifest.json"), JSON.stringify(manifest));
+  return { root, wasm };
+}
+
+test("compiled artifacts and their exact runtime binding are synchronized", (t) => {
+  const { root, wasm } = fixture(t);
+  const result = syncWebEngineRuntime(root);
+  const manifest = JSON.parse(fs.readFileSync(path.join(root, "web/app/public/wasm-module-manifest.json")));
+  assert.equal(manifest.modules[0].resources.single.sha256, crypto.createHash("sha256").update(wasm).digest("hex"));
+  assert.equal(manifest.modules[0].resources.pthread.sha256, "other");
+  assert.deepEqual(fs.readFileSync(path.join(root, "web/app/public/vendor/blender/web_engine.wasm")), wasm);
+  assert.equal(result.changed.length, 5);
+  assert.equal(syncWebEngineRuntime(root).changed.length, 0);
+});
+
+test("invalid builds never replace working runtime assets", (t) => {
+  const { root } = fixture(t);
+  syncWebEngineRuntime(root);
+  const current = fs.readFileSync(path.join(root, "web/app/public/wasm-module-manifest.json"));
+  fs.writeFileSync(path.join(root, "build_web_blender6/bin/web_engine.wasm"), "invalid");
+  assert.throws(() => syncWebEngineRuntime(root), /invalid/);
+  assert.deepEqual(fs.readFileSync(path.join(root, "web/app/public/wasm-module-manifest.json")), current);
+});