feat(capture): verify authored motion in portable HTML

[chubes4]

Why

The script-free LIQUID BONSAI website/ is a truthful static snapshot, but its date stays frozen and its canvas stays blank. Its separately configured WordPress import already passes source motion. Reattaching the source script.js would overwrite Gutenberg edits and violate the source-script policy. #425 requires the portable HTML itself to run and prove its own independent behavior.

Contract

data-liberation <url> --portable-motion <recipe.json> (or authorPortableMotion(runDir, recipe) for an existing capture) accepts an explicitly authored, bounded recipe: existing element data attributes, inert JSON configuration, optional busy-state visibility selectors, and hash-pinned independently authored runtime scripts. The normal source scripts stay removed; any authored script with a captured source-script hash or originating inside the capture run is rejected. The site is staged and checked offline and against the live source at 390/768/1440px before the public website/ changes. portable-motion.json records relative paths and hashes; subsequent plain compare revalidates hashes and reruns motion checks rather than trusting a past pass. A missing/changed script fails closed. The emitted HTML is self-contained and independent of WordPress.

Verification

• Neutral real-Chromium regression: rejects the verbatim source script without changing the artifact; rejects a visually wrong early status indicator without changing the artifact; proves startup status, canvas idle control/pointer input, click replay, and default source-to-portable compare after authoring. Editing exported text causes the independent runtime to replay the edited value. Tampering with the authored script invalidates subsequent comparisons.
• Fresh data-liberation https://liquidbonsai.com/ --portable-motion <reviewed author recipe> captured one route. Author recipe uses the already released generic Blocks Engine canvas, live-clock and text-motion view scripts, with source-neutral configuration. Plain compare <fresh-run> without --candidate passes. Source-to-portable startup/final text and status-dot visibility, visitor-local clock, five click replays, canvas pointer and idle control pass at 390/768/1440px. Screenshot evidence scores 0.9998/0.9999/1.0000 respectively (rounded, informational). Default 1600/1728px text/font comparison passes. Source script bytes remain absent from website/.
• npm run build, npm run test:package, targeted real-browser suites and the large-route capture regression pass. Full unbounded local npm test reached 1397 passing assertions but three unrelated browser teardown hooks exceeded 10s under local concurrency; rerunning those 41 tests with bounded workers passed. A bounded serial full-suite run exceeded its local 15-minute timeout; keep this PR draft pending complete CI.

This is manual authoring, not automatic translation of arbitrary source JavaScript. The raw capture remains diagnosed as originally unreproduced; the authored portable artifact carries separately proven behavior. Source-specific selectors and text live only in the caller recipe, not the product.

Refs #425 and Blocks Engine #2332.

AI disclosure: GPT-6 Sol via OpenCode traced capture script removal and static-date loss, designed the generic opt-in portable-runtime seam, implemented hash-pinned staging and browser verification, and ran fresh live capture/neutral-editable tests. Chris Huber directs the parity goal. This issue-linked direct worktree uses the previously authorized fallback after Homeboy Cook admission blocked; verification and finalization remain outside Homeboy.

[chubes4]

Release readiness update: complete PR CI is green (run), including full browser/package gates. A fresh capture of the live source with the authored, SHA-pinned reusable companion view scripts followed by plain compare (no --candidate) passed source-to-portable startup/final text, pending status-dot visibility, local date/clock, five click replays and canvas idle/pointer behavior at 390/768/1440px; default 1600/1728px text/font checks passed. Source scripts remain stripped. The stage-only negative regression proves omission of the indicator rule fails without changing the original capture.

The downstream editable WordPress reimport of the enriched artifact revealed a distinct BE conversion issue: the existing compiler drops the authored native canvas effect and treats one hidden config marker as a runtime island. BE #2346 is handling this in the owning integration layer; this DLA capture feature is independently green and the standalone portable output remains self-contained.

AI disclosure: GPT-6 Sol via OpenCode verified full CI, fresh source/portable browser parity and the downstream BE failure; Chris Huber directs acceptance.