fix(ui-12b): push modal surfaces karasu watch inline (VAPID-null)

[VDP89]

Summary

• Closes phase-4-dogfood Finding docs: review-loop policy + CLAUDE.md working agreements #3 sub-friction 3 (logged as a follow-up in PR docs: VAPID bootstrap consolidation — closes Finding #3 (sub-frictions 1 & 2) #118's resolution). The UI-12b push modal's VAPID-null foot copy now surfaces the runnable CLI command (karasu watch) inline instead of pointing at a doc.
• Inside the standalone PWA window (installed via UI-14) the operator has no terminal handy and the doc path is not clickable. Putting the command IN the chip means copy + paste works without leaving the window.

Fix

src/karasu/ui/static/js/push.js line 193-195:

Before:

footCopy.textContent =
    'VAPID keys not provisioned. See docs/local-dogfood.md ' +
    'for manual setup.';

After:

footCopy.textContent =
    'VAPID keys not provisioned. Run `karasu watch` in a ' +
    'terminal once to bootstrap.';

Invariants preserved

• Pin §11.6.14: the primary "Enable notifications" button stays DISABLED in this state. The chip change does not enable any new mutation path.
• Notification.requestPermission and PushManager.subscribe remain unreachable from VAPID-null.
• The defensive setPushModalError('VAPID keys not provisioned.') guard at push.js:250 (race-against-stale-payload path) is untouched and stays terse.

Files

• src/karasu/ui/static/js/push.js — foot copy + extended comment linking the change to the dogfood finding.
• tests/test_ui_sw.py::test_push_modal_vapid_null_foot_copy_surfaces_cli_hint — new static text pin in the existing "UI artefact source-level checks" pattern. Asserts the inline karasu watch hint is present + guards against reintroducing the old doc pointer.
• docs/ui/ui-12b-design-brief.md — §3-H amended in-place to seal the new operator-actionable copy and document the regression risk.

What's NOT in this PR

• No dogfood log touch (sub-friction 3 lives in PR docs: VAPID bootstrap consolidation — closes Finding #3 (sub-frictions 1 & 2) #118's resolution block, not on main). Follow-up housekeeping after both merge.
• No Playwright test for the modal-rendered copy. The 4 existing Playwright flows in test_ui_push_modal.py cover the subscribe/unsubscribe contracts; the foot-copy assertion lives at the source level, matching the test_login_html_* and test_index_html_* pattern already established in test_ui_sw.py.

Test plan

• pytest tests/test_ui_sw.py — 18/18
• pytest tests/test_ui_push_modal.py tests/test_ui_modal.py — 13/13 (no flow regression)
• After merge: an operator running karasu ui without karasu watch and opening the push modal from the standalone PWA window should see the karasu watch hint inline and be able to copy it without switching to a browser tab.

Relation to other Phase 4 PRs

Independent of #116-#122. The new test only reads push.js source; no other surface touched.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 326b63e3e4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Make the CLI hint pasteable as shell input

When the modal is shown in the VAPID-null state, the visible text now includes literal backticks around karasu watch. If an operator follows the new copy/paste workflow and pastes that visible command including the backticks into a POSIX shell, the shell treats it as command substitution rather than running karasu watch normally, which can hang or fail instead of bootstrapping VAPID. Since this change is specifically meant to make the modal copy actionable, render the pasteable command without shell metacharacters or style it separately while keeping the copied text as karasu watch.

Useful? React with 👍 / 👎.