Prepare assistant-ui 0.15 migration; hold for bundle performance

[HomenShum]

Developers using the app and its generated chat starter need the same honest Stop/Retry behavior when upgrading the assistant framework. This candidate updates both dependency graphs to @assistant-ui/react 0.15.28 and migrates the two retry guards to the supported property accessor. Existing cancellation, retained answers and explicit retry behavior are preserved.

Draft only; do not merge. The upgrade materially increases the initial JavaScript download, with no measured compensating latency or reliability improvement. An independent build reproduced the increase, and the supported core/react import alternative generated identical executable JavaScript. The current released 0.14 line remains the accepted version pending performance acceptance or an upstream modularity improvement.

Surface	Before gzip bytes	Candidate gzip bytes	Increase
Root app	189,429	269,094	42.1%
Generated starter	123,034	198,798	61.6%

Both columns use the same Node gzipSync method. CSS is byte-identical. These are static build measurements, not browser latency or Core Web Vitals.

The new transitive nanoid dependency also excludes previously advertised Node branches. The root now declares ^22.19.0 || ^24.0.0 || ^26.0.0; the starter declares ^22.12.0 || ^24.0.0 || >=26.0.0. The template README matches. Every locked engine range was checked, including explicit boundary cases. Runtime execution was on Node 22.22.2; Node 24/26 execution is not certified. The root README belongs to the separate model-refresh PR and is untouched.

Validation:

• 117 existing root scenarios pass, including integration with the actual assistant runtime; typecheck, build, dependency tree, frame/durable/SQLite smoke checks, guidance and tours pass.
• An actual newly generated starter passes clean install, 65 existing scenarios, demo, dependency tree and build. Package contents and generator output match the source template. Both root and starter audits report zero findings at the recorded time.
• Chrome desktop and mobile checks exercise complete → Stop → retained earlier answer → explicit Retry on the root app and generated starter. The root retry honestly reports a partial/manual-review answer for its different prompt; the starter completes. Captured DOM, console and pixels are local evidence, not production proof.
• After the engine metadata correction, both builds produce identical HTML/JavaScript/CSS assets to those exercised in Chrome. The generator and starter scenarios pass again.

No model-refresh files, styling, provider routes, scoring policy or proof gates change. No application model call or paid evaluation was performed. Local prepush/check was excluded because it can discover host provider credentials; its deterministic components were run separately. Source and emitted-bundle inspection find no default assistant-cloud request path for the current local adapters; no observed-network claim is made.

Exact candidate identity, independent review and natural CI results will be appended before handoff. This draft does not claim improved model quality, deployment, production readiness or completion of the portfolio framework campaign.

Frozen candidate: 67c7b082d575357206d7d595511873e97f2560c1, tree 37494362284eecebf4ca0afcaef675f646ebf467, parent ab31d8958063e4f6d4a4012dab3ff23153f3843f. Exact staged patch SHA-256: 0e113951d17f18e4f7de3ed3079f2ab90f6b443d709d423cc7f2e16c1e1e1b34. Independent final code review approves draft publication only and simplification passes; no new actionable P1/P2 defect remains after the engine correction. Separate performance review retains the merge hold. Natural CI is pending and will be recorded separately; even green CI does not resolve the download regression.

Natural CI is now green for this exact head: verify run 38579383806 tested synthetic merge 8fec2648ec18e5ced9f273b03161512a496cdc59, with 117 passing root tests and zero production-audit findings. Conformance and GitGuardian checks pass. The live-provider probe explicitly skipped because no provider key was configured. This remains a draft with a performance hold; CI does not establish latency, production behavior or a reason to accept the larger bundle.