feat(ui): export a composeBoot seam so the analytics/clients boot order is testable (RIG-2874)

[rigel-mintaka]

This PR is part of a stack containing 4 PRs:

1. main
2. "feat(ui): export a composeBoot seam so the analytics/clients boot order is testable (RIG-2874)" (this PR)
3. docs(ui): route the undefined session-id case to the direct seam (RIG-2874) #1097
4. fix(ui): trim the boot comments after the composeBoot extraction (RIG-2874) #1104
5. docs(ui): anchor the captureRequest citation by its thrown string (RIG-2874) #1105

Makes the analytics/clients boot order testable. Matt approved exporting
this seam directly; it closes the one open item from #1055 that had no
automated coverage.

Why the order was untestable

main(root, connection) (index.tsx:87) is a module-private async function
that renders into a live DOM root and performs a WhoAmI round-trip before it
returns, and importing the module executes the top-level boot branch at :59.
So no test could reach the construction pair.

Worse, a wrong order is invisible to every automated signal, because both
correlation directions are lazy getters:

• traceId: () => clients.traceId.current — a forward reference into
  clients, safe only because it fires at capture time, after the next
  statement binds.
• sessionId: () => analytics.sessionId()

Invert the two and it still typechecks, still renders, and still passes the
visual smoke. It fails only at the TLS network door, as a missing
X-POSTHOG-SESSION-ID header — and the dev door produces a false negative
indistinguishable from a broken UI half. That is why T4's acceptance was
manual.

The change

composeBoot(deps) in apps/ui/src/compose-boot.ts takes the connection plus
optional factory overrides (defaulting to the real createAnalytics /
createLiveClients / analyticsConfigFromEnv) and returns both built objects.
main() now destructures it. Production behaviour is unchanged: same
order, same two lazy getters, same forward reference.

Why a separate module, not inside index.tsx

index.tsx cannot be imported under bun test — it drags in the
./mount → App render graph. Verified with a throwaway probe:

error: Cannot find module 'react/jsx-dev-runtime' from '.../apps/ui/src/mount.tsx'

mock.module was not used as a workaround: it leaks process-wide, which
test-setup.ts warns about. Placement only — the exported symbol and
signature are the approved ones.

The test is real

compose-boot.test.ts asserts observable consequences, not call order: the
clients did not exist when analytics was built; the sessionId getter the
clients received resolves through to the analytics instance; the traceId
getter the analytics received resolves through to the clients' slot (the
forward reference, live). Fakes are a real in-memory LiveClients over
createRouterTransport — no as cast.

Proven by inverting the two construction lines and re-running:

expect(clientsExistedWhenAnalyticsBuilt).toBe(false)
Expected: false   Received: true
0 pass, 1 fail

Order restored (file confirmed byte-identical via cmp), 1 pass.

Gates

Re-run after rebasing onto current main (332a733f), which had moved.

• bun test compose-boot + analytics + live/client — 30 pass / 0 fail
• bunx tsc --noEmit (apps/ui) — rc=0
• bunx biome check (3 files) — rc=0

RIG-2874

[linear-code]

RIG-2874

[trunk-io]

😎 This pull request was merged.

[github-actions]

Compass engineering docs preview: https://compass-ui-rig-2874-composeb.compass-eng-docs.pages.dev

Deployed from compass-ui/rig-2874-composeboot-seam at cab805b.

[trunk-io]

This pull request was merged into main as part of stacked PR 1105.