feat(native): add cross-platform renderer foundation - #506

Summary

Adds the source-only React Native platform alongside the existing Web renderer: shared design tokens/contracts and @vllnt/ui-core, 171 Native source modules, an Android/iOS Expo catalog, and synchronized fail-closed Native canary tooling. Stable Web installation remains @vllnt/ui@^0.3.0; this branch prepares VLLNT UI 0.4.0 without publishing it.

Registry discovery uses one component catalog, renderer-aware navigation, a capability filter, platform comparison, and extensible implementation source tabs beside the existing Web preview. Locale and unrelated query state are preserved. Retired /native routes redirect into the filtered catalog. Native source availability is explicit throughout registry/MCP/LLM surfaces and localized metadata.

Final review fixes

• Accessible mobile search/locale controls and navigable localized Suspense fallbacks; inert collapsed sidebar; unique card action names; valid source-tab relationships/hash navigation.
• Localized Native 0.4.0 SEO and documentation; JSON-LD graph documents; reduced-motion preview placeholders; safe static sidebar thumbnail fixture.
• Native disclosure/tab ARIA, date/time controlled clearing, inline editing baselines, dynamic resizable constraints, timeline accessibility invariants, link adapter/rejection handling, and animation lifecycle regression tests.
• Registry preview triggers now include packages/ui-core, packages/ui-native, and packages/design.
• Expo SDK patch aligned to 57.0.20; lockfile changes limited to that dependency family.

Validation — HEAD 63856b8

All four workspace gates were repeated successfully on the final source tree. Follow-ups make Native catalog text wrappers explicit, preserve Step identity with cloneElement, restrict CI token permissions, and replace backtracking-prone filename/MDX expressions with bounded matching and regression tests. The generated MDX registry mirror was rebuilt and committed.

• pnpm lint --concurrency=1 — all 6 workspace packages passed.
• pnpm -F @vllnt/ui exec tsc --noEmit --project tsconfig.build.json — passed.
• pnpm build --concurrency=1 — all 6 workspace packages passed, including Android/iOS exports.
• pnpm test:once --concurrency=1 — all 6 package tasks passed; Web: 318 files / 1,677 tests; Native: 17 suites / 100 tests.
• PLAYWRIGHT_BASE_URL=http://localhost:4306 pnpm -F @vllnt/ui-registry exec playwright test --workers=1 against the production build — 79 passed, 7 skipped (live Storybook checks opt-in); includes EN/FR Native SEO, JSON-LD, responsive platform navigation, i18n, MDX and themes.
• 320px mobile smoke — search opens its dialog, locale switch keeps Native/unrelated query state, no horizontal overflow; reduced-motion screenshot inspected.
• Local embed smoke — 313/313 thumbnail pages resolved without fatal errors; this is not a blanket hydration-warning clearance.
• pnpm check:circular; Native barrel/boundary checks; core/Native/catalog typechecks; core/Native/Web packed-package checks — passed.
• registry:check, registry:integrity, i18n:check — passed; 313 registry entries, stable install target ^0.3.0.
• Story coverage and required-prop verification — passed for 313 components.
• Final Expo catalog: Doctor 21/21, typecheck, test, Android and iOS Metro exports — passed.
• Frozen-lockfile install, git diff --check, pre-commit React Doctor error gate — passed (warnings remain).
• Independent read-only remediation review — no material findings; this is not security clearance.

Parallel validation hit the local resource supervisor; serialized runs succeeded. No gates were bypassed.

Exact-head remote evidence

• All GitHub checks green at 63856b8, including Quality, Native, E2E, Storybook, React Doctor, and CodeQL (zero new alerts). CI: https://github.com/vllnt/ui/actions/runs/33925456806
• ntk deployment 6273982049 reports success for full SHA 63856b85e1dc08960338f768b5d6f64763abfd58 at https://pr-506-ui-registry.preview.vllnt.ai
• PLAYWRIGHT_BASE_URL=https://pr-506-ui-registry.preview.vllnt.ai pnpm -F @vllnt/ui-registry exec playwright test --workers=1 — 86/86 passed, including live Storybook checks, Native SEO, localized routes, source/preview navigation and themes.
• 320px mobile search, locale/query retention and no-overflow smoke also passed on that exact-head preview.

Full base-to-head visual comparison

Independently generated all 305 existing visual fixture baselines from origin/main (38db630) in a detached worktree. Same installed dependencies/browser, reduced-motion preference, no source edits. Then rebuilt HEAD 63856b8 with a separate CT cache and compared against those base snapshots with snapshot updating disabled. No new expectations were generated from HEAD.

# Base worktree at 38db630, external snapshot directory
pnpm -F @vllnt/ui exec playwright test -c playwright-review.config.ts --workers=1 --update-snapshots
305 passed, 0 skipped, 0 flaky (131s)

# HEAD at 63856b8, same snapshots, isolated build cache
pnpm -F @vllnt/ui exec playwright test -c playwright-review.config.ts --workers=1 --update-snapshots=none
305 passed, 0 skipped, 0 flaky (83s)

Review config inherits playwright-ct.config.ts, runs every *.visual.tsx, sets retries: 0, reducedMotion: 'reduce', external snapshot/output paths and a distinct ctCacheDir per tree. The existing 2% pixel-difference tolerance is unchanged. JSON reports and configs are retained under /tmp/pr506-full-visual/. Six affected fixture baselines were also visually inspected. The existing tabs fixture renders only text, so keyboard/ARIA evidence remains in unit/E2E suites. No baseline images were committed.

Remaining gates — keep draft

• Await prerequisite integration: PR #508 now at 5c0ff29 repairs the committed-baseline gate and removes a remote-image fixture flake without changing its baseline. Synthetic integration with this PR is conflict-free and passed 305/305 strict Linux tests in 3.2m (--workers=1 --retries=0 --update-snapshots=none; synthetic commit 4f3efa5, tree 05e0c77e728b969e42e1ca3de15d9c0d48c14657). All shipped source/lockfile match this PR; baselines/config match ci: enforce committed Linux visual baselines #508. This is not exact-head CI for PR506. PR508's fresh visual and all code CI are green, but its latest preview attempt reports both app builds failed (exit1), superseding earlier attestation HTTP429. Preview log retrieval is blocked by ntk authentication (convex token failed (404)); restore access to diagnose before retrying. It remains draft pending preview recovery. No merge is authorized here. Integrate the prerequisite and rerun exact-head gates before clearing this draft.
• This branch's existing green “Visual Regression” status still used --update-snapshots; it is execution evidence, not the durable comparison gate. The independent base-to-head comparison above remains valid. PR ci: enforce committed Linux visual baselines #508's green result is not claimed as an exact-head check for PR feat(native): add cross-platform renderer foundation #506.
• Security-specialist execution was blocked by its isolation policy. No security clearance claimed. GitHub also reports existing default-branch dependency advisories.
• Physical iOS/Android and assistive-technology verification remain outstanding; Metro exports are not device proof.

Release boundaries

No merge, production deployment, package publication, or latest tag change is authorized by this PR. Native availability intentionally remains source / installation unavailable. Canary publication stays disabled until trusted-publisher/environment setup and explicit enablement. The documented post-publication availability transition is a separate reviewed follow-up after both packages and synchronized canary tags are verified.

Related to #479