feat: unify Oven event architecture and official catalog

[alowpoly]

What

• Publish durable post-commit observational events for canonical Oven data, bindings, definitions, lifecycle moves, and burns. Events invalidate canonical snapshots; they never become an alternate state store.
• Route ordinary JSON Ovens through one process-wide snapshot store, projection coordinator, response-admission path, and browser snapshot client with ETags, conditional reads, bounded caches, and last-good data.
• Preserve bounded vector replay for exact browser consumers while keeping wildcard project projections live through a non-replay server-tail subscription. The server-tail uses internal paged watermarks beyond the public 64-stream replay limit and conditionally reconciles when it opens.
• Remove handler warming, page-owned polling, the legacy /ovens/<id>/view route, and private response caches. Streaming Diff content SSE and the Differential Testing worker inbox remain separate specialized transports.
• Add ovens/catalog.json as the non-executable authority for the six official Ovens: Checklist, Differential Testing, Model Lab, Performance Tracing, Streaming Diff, and Visual Parity.
• Separate each official Oven's producer-facing inputContract from its declarative renderContract, including Performance Tracing's adapter boundary.
• Keep official membership separate from repository-local availability. Vendored and custom Ovens stay declarative and repository-scoped; Run Burn resolves the effective Oven from the target repository.
• Record a coarse runtimeCompatibility contract in new pins. Existing valid five-key pins are read as burnlist-oven-runtime@1 in memory without rewriting committed files.
• Preserve official, vendored, and custom identity in catalog/explainer UI, repository links, and revision-matched sample selection.

Guarantees

• Canonical repository data remains authoritative; events are post-commit invalidation signals only.
• The dashboard remains a read-only observer of canonical Burnlist state. Controller writes remain explicit, token-gated, loopback-only local actions.
• Ovens remain declarative and non-executable, and runtime dependencies remain zero.
• Vendoring pins declarative source and instructions, not the installed CLI validator, server handler, adapter, or renderer. runtimeCompatibility is the explicit coarse compatibility gate.
• Acceptance qualification and retained-evidence verification are intentionally out of scope for this PR. No evidence verifier or evidence-class claim is shipped.

Validation

• npm run build:dashboard — passed
• npm run verify — passed
• npm run verify:package — 143 files, 1,572,285 bytes unpacked
• Focused event/browser/vendor regressions — 47 tests passed, including wildcard event/reset invalidation and a real 65-stream live subscription
• GitHub CI — passed on Node 18, 20, and 22
• git diff --check — passed
• No oven-catalog Oven/package exists