Phase A2: migrate demo onto canonical generateSandboxedUi rails

- CopilotRuntime now sets openGenerativeUI: true (auto-applies
  OpenGenerativeUIMiddleware; options extracted to a tested builder)
- Demo-owned activity renderer for "open-generative-ui" events overrides the
  built-in via renderActivityMessages: keeps CSS-first gating + adds design
  system & importmap injection, idiomorph preview morphing, and continuous
  ResizeObserver autosize (demo non-regressions)
- Zod-validated sandboxFunctions: sendPrompt (chat bridge via CustomEvent +
  OpenGenUIPromptBridge) and openLink (https-only + optional origin allowlist)
- OPEN_GEN_UI_DESIGN_SKILL replaces the default shadcn designSkill
- Python agent prompt contract switched widgetRenderer -> generateSandboxedUi
  (ordered params, css-first, Websandbox.connection.remote bridge, dynamic
  imports), protocol & quality bar preserved; prompt hoisted to src/prompt.py
- 60 app tests + 15 design-system tests + 8 pytest, all red-green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>