feat(cli): make init bootstrap UI AST-first

[mikeylong]

Summary

• make interfacectl init AST-first for first-run bootstrap
• emit JSON handoff metadata for downstream onboarding consumers
• keep the compatibility contract derived-only while writing bundle v3 artifacts

Testing

• pnpm --filter @surfaces/interfacectl-cli build
• node --test packages/interfacectl-cli/test/init-auth.test.mjs

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7fab67f2ba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject unsupported surfaces instead of silently dropping them

deriveLegacyContractFromUiAst skips any surface when getWebProjection(surface) is missing or lacks layout, so AST inputs with iOS/Android-only surfaces (or web surfaces missing layout) are silently removed from the derived contract. resolveUiAstInput then feeds that derived contract into compile, validate, diff, and enforce, which means those commands can succeed while completely ignoring affected surfaces (for example, compile emits no surface bundle files for them). This should produce an explicit validation error rather than silently continuing.

Useful? React with 👍 / 👎.