feat(preview): implement a typed, sandboxed live-preview protocol

[7shep]

Problem

Preview currently shows fixture states only. It cannot receive a generated URL, validate host messages, render an isolated iframe, or report ready/error/reload events.

Suggested level: Advanced
Primary area: apps/preview and one narrowly owned protocol module
Roadmap: Phase 2

Acceptance criteria

• Define typed messages for project identity, URL, build state, reload, viewport, readiness, and runtime errors.
• Validate shape and trusted origin before state changes.
• Use an iframe with the minimum justified sandbox capabilities.
• Support loading, building, ready, stale, crashed, and unavailable states.
• Provide desktop/mobile controls and manual reload.
• Preserve diagnostics across refreshes.
• Test validation, untrusted origins, transitions, reload, and partial failure.
• Meet keyboard, focus, responsive, and reduced-motion requirements.

Repository workflow

Follow AGENTS.md: obtain design direction/rules, run the app, submit React/CSS to review_implementation, and address practical high-severity findings.

Consume the merged runtime lifecycle contract; use fixture messages until then.