Add the Spock-backed Instagram demo and editor/play workflow

[softmarshmallow]

What changed

• add a Spock-backed Instagram demo with feed, profiles, connections, posts, stories, reels, search, upload/publish, comments, likes, saves, actor switching, and signed media
• add the read-only Editor and prototype-style Play host, including selectable previews and plain-language computed example-data origins
• add the small Uhura primitives needed by the demo: map values, replacement navigation, live-provider selection, and image/video/upload handling
• migrate Editor, Play, and the app-owned Spock provider from JavaScript to strict framework-free TypeScript, with tests and checked-in browser artifacts
• document the demo architecture, dogfood findings, and deferred provenance/editing model

Why

This makes the Instagram slice an end-to-end dogfood path: examples remain deterministic for checking and Canvas, while Play uses Spock GraphQL, RPC, identity, and storage as its remote authority. The TypeScript package lets the editor/play tooling grow without introducing a frontend framework or a Node runtime dependency for normal Uhura use.

Review notes

• Value::Map preserves provider UUID keys across decode, evaluation, state, iteration, and serialization while retaining the existing JSON object wire shape.
• navigate replace is carried through syntax, checking, IR, Core intents, traces, and host application. It preserves stack depth, mints a fresh page instance, resets state, and sweeps orphan surfaces.
• the live provider module is trusted project code loaded only by Play; checks, Canvas, and traces remain fixture-driven
• preview provenance is editor-only metadata; examples remain outside runtime IR and the inspector is read-only
• web/dist/** and examples/instagram-uhura/providers/dist/** are intentionally checked in; CI verifies they match TypeScript source
• the live demo currently expects Spock at 127.0.0.1:4000; dynamic umbrella-runner port injection/readiness belongs to the companion Spock change

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• pnpm -C web check (typecheck, lint, builds, 27 tests)
• CLI fmt --check, check --deny-warnings, trace, and project smoke tests
• cargo build --locked -p uhura-wasm --target wasm32-unknown-unknown
• generated-artifact cleanliness guard
• browser smoke checks for Editor selection, read-only provenance, and Spock-backed Play