test(runner): close the DEV-2530 guide/tests parity gaps

[danielzytohoc]

Closes every remaining item on DEV-2530 — the coverage gaps left from the DEV-2203 guide/tests parity audit. All deterministic: everything here runs in PR CI, no live tier, no fixture demo, no product-code changes.

Item	Where	What's pinned
1 · revoked card UI	authed-actions.spec.ts	badge stays, kebab disappears entirely (stronger than the ticket's "loses actions" — MyDemos renders no kebab at all), live card as the control
2 · share dialog links	authed-actions.spec.ts	the three labelled fields by exact accessible name, and Copy link proven equal to the dialog's client link via the real clipboard
3 · versionLocked	all-demos.spec.ts	/share/:id renders text, not a menu — no trigger/pencil/input, click opens nothing; playground as the interactive contrast; pinned value steered off the DEFAULT_VERSION fallback
4 · zip parity	editor-download.spec.ts	FILES-header and top-bar downloads compared per-entry (names + decompressed bytes; whole-zip bytes legitimately differ by mtime), marker in both
5 · docs picker search	docs-picker.spec.ts (new)	cross-category, cross-section reach; click and keyboard selection land ?docs=; garbage query → empty state
6 · container boot UX	container-boot-ux.spec.ts (new)	"Starting the live dev server…", Details log tail verbatim, and both resolutions (error card cause-first / iframe pointed) — the Tier-2 lifecycle stubbed as three HTTP shapes, no container
7 · /admin smoke	admin-panel.spec.ts (new)	login wall (no render, no admin fetch, redirect polled), one row per session, awake/slept labels, usd() branches, billable-basis tooltip, pager offset arithmetic
8 · bare-ref boundary	ht-version-resolve.test.mjs	999 refused with the validator's exact message / 1000 accepted → tarball URL; same threshold in package.json derivation

Verification. Every test is mutation-checked — 18 targeted product regressions each redden exactly the tests that claim to guard them (matrix in the workflow log; e.g. dropping the revoked-kebab guard, rewording Public client link:, versionLocked={false}, diverging the two zippers, narrowing searchLeaves to titles, reordering tailLines, dropping the login wall, moving the 1000 threshold both ways). Full deterministic run: 48 passed / 0 failed; pipeline suite 893/0; three independent adversarial reviews (hollow, cannot-fail, drift) all CLEAN, and their nice-to-have notes are already applied (the polled redirect counter, two comment corrections, the dist-staleness note).

One out-of-scope find from review, not in this diff: EditorShell.tsx:489 contains a literal NUL byte (since DEV-2583) that makes grep/file treat the source as binary — worth a one-character follow-up.

---

Note

Low Risk
Test-only changes with stubbed HTTP; no production logic, auth, or data paths modified.

Overview
Adds deterministic Playwright and pipeline tests to cover the remaining DEV-2530 guide parity items—no application code changes.

New E2E specs stub APIs and assert user-visible behavior: admin-panel.spec.ts (login gate, live sessions table, cost formatting, pager offsets); container-boot-ux.spec.ts (Tier-2 boot caption, Details log, success/error resolution); docs-picker.spec.ts (cross-catalog search, selection, keyboard, empty state).

Extended specs pin share-route version lock (all-demos.spec.ts), revoked My demos cards and share dialog link parity including real clipboard (authed-actions.spec.ts), and FILES-header vs top-bar zip identity (editor-download.spec.ts).

ht-version-resolve.test.mjs adds tests for the bare numeric 999 vs 1000 major vs pkg.pr.new boundary and notes that the suite imports runtime dist (build before direct runs).

^{Reviewed by Cursor Bugbot for commit 2835611. Bugbot is set up for automated code reviews on this repo. Configure here.}