Verify native surfaces for upstream aab404964 batch

[berghtho]

Upstream batch

Frozen upstream: aab4049646ffa8b9bcff92562992e6c3a8554bf0
Integration head: 89b75af57e1d7792073fcd0eb3b3b24cda1bda8a

Why this blocks merge

The batch spans 90 commits, 661 files, 38,160 additions, native Ghostty binaries, macOS desktop preview/update paths, mobile native code, and 12 both-sided fork/upstream files. The daily-sync runbook stops when a batch cannot be reviewed reliably in one session.

Windows verification found and fixed one real fork regression: upstream deleted ui/card.tsx while the fork-only Lead Agent page still imported it. The final head passes mandatory Riker tests and contracts/server/web typechecks.

Native evidence remains incomplete:

• macOS desktop preview and remote-update behavior not exercised.
• iOS/Android native module and Ghostty binary behavior not exercised.
• WSL Linux reproduction blocked by Node 22 versus required Node 24 and missing make for node-pty.
• Windows-only failures remain in ten files byte-identical to upstream; they need native-host classification, not waiver.

Completion gate

Review the native/macOS/mobile risk areas, reproduce host-sensitive suites in a supported native environment, update the draft sync PR with evidence, rerun the mandatory Riker baseline on the exact head, then merge only if every runbook gate passes.