Phase A3+A4: retire legacy widgetRenderer rail; skills on procedural channel

A3 (apps/app):
- Delete widget-renderer.tsx and its useComponent registration; guard test
  pins zero widgetRenderer/widget-renderer references in src
- Export overlay now rides the canonical activity content via
  assembleStandaloneHtmlFromActivity (importmap -> design system -> css ->
  Websandbox stub -> html -> jsFunctions/jsExpressions)
- Legacy open-link postMessage handler hardened via isAllowedLinkUrl
- template-card imports THEME_CSS from @repo/design-system

A4 (apps/agent):
- All three SKILL.md files rewritten to generateSandboxedUi ordered contract:
  css-first reveal, jsFunctions toolbox + jsExpressions stepwise invocations,
  parameterized generators for one-expression refinement turns, Websandbox
  bridge calls, dynamic-import library guidance; quality bar preserved
- 17 new pytest contract tests (red-green); 25 total green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>