Add a verified Vite and WebLLM consumer starter

[aantenore]

What changed

• add a clean Vite consumer that uses only published TabLoom exports
• pin TabLoom, WebLLM, the Hugging Face model revision, the WebGPU WASM revision, lock integrity, and artifact SRI
• bind model artifacts and broker, generation, host, and topology policy into one runtime fingerprint
• use the same fail-closed engine configuration in the page and SharedWorker paths
• add clean package-consumer smoke, browser coverage, and an opt-in real WebGPU generation gate
• pin GitHub Actions by immutable SHA and harden release checkout credentials

Why

A reusable local-inference control plane needs a consumer that proves the public package surface, runtime identity, artifact integrity, and owner handoff work together outside the source tree.

Impact

Developers get a runnable starter that keeps prompts in the selected browser owner, fails closed when pinned artifacts drift, and demonstrates TabLoom topology selection with a real model.

Validation

• pnpm check: 125/125 tests; 88.02% statement coverage
• package smoke against the verified release and a newly packed local artifact
• browser matrix: 30/30 across Chromium, Firefox, and WebKit
• live Chrome/WebGPU generation: 1/1, no page or console errors
• production/high audit: no vulnerabilities
• all SRI and release hashes independently recalculated
• canonical Git identity and forbidden-literal scan

Residual development risk

A low-severity advisory remains in the transitive Windows development server path of tsup/esbuild; it is outside production dependencies and the compatible range currently declared by tsup, so this PR does not force an incompatible override.