add first-class generated UI renderers

[siddarthvader]

What changed

• add first-class GeneratedUiRenderer<TTarget> and render-session contracts
• make renderer selection explicit across the Svelte, React, Solid, and Vue adapters
• add DOMPurify as the sole built-in browser renderer with an exact generated-UI policy and DocumentFragment commits
• organize the generated-UI domain under src/ui with thin compiler, policy, renderer, and DOM-session modules
• remove the direct innerHTML renderer and legacy gruntend-sdk/ui/dom mounting shortcut
• update the SvelteKit example, README, release smoke imports, API reference, architecture docs, and documentation website
• add a minor changeset for the public renderer API and adapter requirements

Why

Generated code should produce UI values without selecting how those values reach an application-owned target. Making the renderer an explicit host-selected strategy keeps compilation, markup sanitization, JavaScript execution, and tool authorization as separate boundaries while preserving an interface for custom render targets.

DOMPurify is the normal built-in browser path. Applications that need another target or commit strategy can implement GeneratedUiRenderer<TTarget> directly instead of relying on a second built-in HTML sink.

Developer impact

Framework adapters now require a renderer prop. Create the renderer once for the mounted component lifetime and pass it with the GeneratedUi controller.

The package adds gruntend-sdk/renderer and gruntend-sdk/renderer/dom-purify. The generated-UI compiler remains available through gruntend-sdk/ui-runtime for compatibility, backed by its new domain location.

Validation

• Format
• Lint
• Test
• Library typecheck
• Package build
• SvelteKit example build
• Website build
• git diff --check
• stale public renderer and legacy mount reference scan

All GitHub CI jobs pass.