M6: Share bundle + zero-install viewer (wit-share, viewer/)

[sepehrsadri]

M6: Share bundle + zero-install viewer (wit-share, viewer/)

Tracking issue for the M6 milestone. Restored to the 0.0 pilot in the M0.5 truth-up — an earlier pass of docs/ROADMAP.md deferred this to 0.1; "Copy as text" (M5) was going to be the only share surface. Both now ship: Copy-as-text stays a first-class, equal path (not a fallback), and the self-contained HTML file is an additional artifact.

Scope

• New crate wit-share (bundle builder) + viewer/ (the zero-install recipient page, built with vite-plugin-singlefile).
• One self-contained .html per share: plain-sentence compare, inline SVG waveform, base64 data-URI audio (opt-in, never transcoded) — designed to render with JavaScript disabled, because iOS Quick Look does not execute JS (this killed an earlier dynamic-viewer design — see design-review-1).

Guardrails

• Static-first architecture is mandatory, not an enhancement — the whole point of M6 is the file rendering without a script engine.
• Hostile track/project names must be tested for HTML/data-island escaping.
• CSP meta tag; zero network requests of any kind.
• Size preview must show the base64-inflated size (×4/3 over raw), not the raw byte count — otherwise the preview lies about what a recipient downloads.
• viewer/ gets a CI size budget of ≤ 1.5 MiB, checked in the app CI job.
• No accounts, no cloud, no hosted viewer (ADR-0006 / the plan's out-of-scope list — a hosted viewer was rejected partly on the decompression-amplification and trust arguments).

Exit criteria

• AirDrop the .html to another Mac — opens correctly, no network calls.
• Open it on a physical iPhone via iMessage/Quick Look — sentences, waveform, and audio all render with JS off. (This is a hardware test, not a simulator test — the earlier dynamic-viewer design passed every automated check and still failed this one.)