Feat/spindle expansion for loom editor extensions

[TheLiquorPriest]

Add capability-bound generation orchestration to Spindle

NOTE: The lumiverse-spindle-types package

Is sourced from my own fork awaiting a merge, so both package.json files will not be modified once that is reflected in staging.

Executive summary

This PR adds a generic, permissioned generation-orchestration contract to Spindle. During an authenticated interceptor callback, an extension can work from an immutable host-captured
request snapshot, resolve the exact connection dispatch, assemble the native prompt, run tracked auxiliary generations, and—with a separate privileged permission—submit a candidate final
assistant response.

Lumiverse remains authoritative over user identity, connection secrets, revision validity, cancellation, deadlines, provider fallback, post-processing, persistence, events, and cleanup.

This PR also adds a versioned host-capability descriptor and frontend/backend compatibility handshake, plus predictable asynchronous frontend readiness, awaited teardown, and host-locale
access. This allows extensions and hosts to reject incompatible combinations before extension code executes.

It adds no new first-party workflow or extension-specific UI. Normal and Continue generation now capture the bound host state needed by these APIs, but ordinary provider behavior remains
unchanged unless an eligible extension explicitly participates.

No Breaking Changes to existing Lumiverse instances or extensions

This PR does not collide with existing functionality or require extensions to be updated, though I'd recommend you take advantage of the additions where applicable.

Why?

The purpose is to let advanced Spindle extensions coordinate multi-stage generation without exposing internal databases, credentials, or unrestricted provider access—and without transferring ownership of critical generation behavior away from Lumiverse.

This lays the ground work for allowing Spindle extensions to introduce behavior to the Loom Editor and logic to its generation pipeline, for example if one desired to write an extension that allows certain prompt blocks to be separate responses from separate agents from the main chat agent that then feed their responses into the preset pipeline, you could do so now.

Essentially the goal is to provide safe and complete control over the Loom Editor and native response generation systems to extensions. This PR achieve this.

Main capability groups

• Bound generation context
  • Immutable connection, preset, retrieval, prefill, and request snapshots
  • Exact revisions and per-user dispatch epochs
  • Host-resolved connection dispatch rather than extension-supplied credentials or endpoints
• Tracked orchestration APIs
  • Native prompt assembly inside the active generation
  • Tracked auxiliary provider calls
  • Receipts, deadlines, cancellation propagation, and parent-request containment
• Lifecycle-safe interception
  • Fail-closed filters
  • Frozen callback context
  • Registration and permission identity
  • Terminal leases preventing stale or repeated completion
• Privileged final responses
  • Separate final_response permission that is never automatically granted
  • Host validation and final selection
  • Native fallback when the candidate is missing, invalid, revoked, or ineligible
  • Existing persistence, processing, breakdown, and event behavior retained
• Explicit compatibility
  • Versioned host capability map
  • Minimum Lumiverse version enforcement
  • Nonce-and-digest frontend/backend handshake before bundle loading
  • Async frontend setup, deferred readiness, and awaited teardown

---

Status: NOT READY

TESTING AND GAP PASS:

• Windows clean instance - no IPC (deepseek)
• Windows clean instance - with IPC (deepseek)
• Windows on my production clone - no extensions - no IPC (GLM)
• Windows on my production clone - Lumi Realm | Lumi Agent | Lumi Books - no IPC (GLM)
• Windows on my production clone - no extensions - with IPC (GLM)
• Windows on my production clone - Lumi Realm | Lumi Agent | Lumi Books - with IPC (GLM)
• macOS clean instance - no IPC (deepseek)
• macOS clean instance - with IPC (deepseek)
• macOS on my production clone - no extensions - no IPC (GLM)
• macOS on my production clone - Lumi Realm | Lumi Agent | Lumi Books - no IPC (GLM)
• macOS on my production clone - no extensions - with IPC (GLM)
• macOS on my production clone - Lumi Realm | Lumi Agent | Lumi Books - with IPC (GLM)
• test against all behaviors made possible by this PR with my extension that implements them

ISSUES OBSERVED:

• a host-created AbortSignal inside the interceptor context and then sends that context across the Spindle runtime IPC boundary. AbortSignal is not structured-cloneable in Bun.
• HostContainmentFatal identity is lost across the worker wire, reconstructed as a generic Error, then swallowed by interceptor fallback.

---

Validation (stale)

Environment: Bun 1.3.14

• Repository-wide unit suite: bun test

  • 2,078 passed
  • 9 skipped
  • 0 failed
  • 8,163 assertions
  • 2,087 tests across 262 files

• Isolated frontend unit suite: cd frontend && bun test
  - 427 passed
  - 0 failed
  - 1,649 assertions
  - 427 tests across 76 files

• Backend TypeScript: bunx tsc --noEmit -p tsconfig.json

• Frontend TypeScript: cd frontend && bunx tsc --noEmit