feat: enable generative UI, A2UI actions, tables and forms (S8)

[davidmckayv]

What this changes

Closes FOR-300.

S8 enables generated interfaces by default and carries graphical output through the selected Bot's AG-UI conversation. It adds sortable tables and validated forms, integrates the pinned public A2UI renderer (including actions back to the selected agent), and passes UI catalog context through the bundled Python/TypeScript harnesses.

The playground now rejects invalid JSON, confirms draft saves/publication, and renders published custom components in the admin gallery. Existing per-Bot component grants still apply. OPENBOT_GENERATIVE_UI=false or 0 disables generated HTML and A2UI.

Where it runs

• No new durable store, port, listener, or schedule. Components use the existing database and publish mutations; conversations use existing Intelligence history and event fan-out.
• Harness catalog context is request-local and never enters checkpoints. Another replica receives the current run's context through AG-UI.
• A2UI actions use the channel's SDK agent instance and thread. They resume the selected Bot through the existing runtime ingress.

Boundary and audit

• Existing gallery/custom-component grants and server decisions remain in place. Declarative A2UI actions resume the Bot; they do not gain a direct route to protected application operations.
• Published previews render sandboxed published source, never unpublished draft code. Draft/sample editing remains admin-only.

Changelog

Added an Unreleased entry and updated configuration documentation.

Proof

CI is green on 63b8eb38, including 3,573 passing main-suite tests, Python harness regressions, build, types, lint, and final verification.

Visually exercised the candidate browser build and the installed Mac desktop shell against the real selected LangGraph agent and Intelligence service:

• Numeric table sorting; required form validation and submitted values acknowledged by the Bot.
• A2UI field edits and buttons: browser acknowledged Kyoto; native Mac acknowledged Oslo.
• Generated HTML counter clicked from 0 to 2 in both browser and Mac.
• Playground edit, preview, invalid-JSON rejection, save, publish, reopen, and agent invocation; published preview visible in the Mac admin gallery.
• Light/dark and narrower browser layouts; a new isolated browser context restored both A2UI cards and both generated HTML interfaces after later turns.

Screenshots and validation evidence in FOR-300. The temporary authored fixture was deleted after validation.

Regression checks: 19 focused UI tests, 33 channel-history tests, 107 configuration/health tests, 14 TypeScript harness history tests, 13 Python AG-UI protocol tests, and 15 compose/provider probes passed. App/server/harness TypeScript checks, scoped Biome, frozen Bun lockfile verification, and the production app build passed. Existing native binary used; no OS-specific changes or native rebuild.

Companion Intelligence #1233 fixes the history API projection discrepancy tracked in FOR-301. AG-UI event replay restored the real app's graphical history in the fresh-session check; the companion fix makes the messages API retain those activities too.

[linear-code]

FOR-300