fix(ui): gate legacy delegate migration on current delegate response

[sanity]

Problem

A long-running River user reports newly-created rooms silently disappearing after page refresh (#253). Root cause: a race between the current delegate's load-rooms response and the legacy migration probes.

`set_up_chat_delegate()` was firing both the current delegate's load-rooms request and the legacy migration probes concurrently at startup. Each legacy response that returned data triggered `save_rooms_to_delegate()`, writing whatever was currently in `ROOMS` to the current delegate's storage.

When a legacy response arrives before the current delegate's response, `ROOMS` still holds an empty or partial state, so the legacy-triggered save overwrites the current delegate with stale data. On next refresh, the current delegate returns the overwritten state and recently-created rooms are gone.

The user reports this happening repeatedly across refreshes, which is consistent with: the localStorage "migration done" flag only gets set after a successful save, so if save races and writes incomplete state, the flag may still be unset, and the migration re-runs each session.

Approach

Gate legacy migration on the current delegate's response so it only fires when there is nothing to clobber:

• `set_up_chat_delegate()` no longer fires migration probes.
• When the current delegate returns rooms_data successfully, mark legacy migration done across sessions — current is the source of truth.
• When the current delegate returns no rooms_data, then fire the legacy migration probes. With current empty, no race possible.

Trade-off: a user with data in both current and legacy (e.g. an interrupted migration in the past) will not get the legacy data merged. But the alternative — the current behavior — actively destroys newer data, which is much worse. The legacy data path was always best-effort recovery from old WASM versions; the new state is what the user has been actively building.

Testing

• `cargo check -p river-ui --target wasm32-unknown-unknown --features no-sync` ✅
• `cargo test -p river-core --test migration_test` ✅ (4/4)
• `cargo fmt --check` ✅
• `cargo clippy` produces no new warnings (4 pre-existing warnings unchanged)

A deterministic unit test for this race is impractical: it requires WASM, WebSocket, Dioxus signals, and a specific async ordering. The fix is structural — legacy probes are gated behind a single response — so the proof is by inspection of the changed control flow.

Closes #253

[AI-assisted - Claude]

[sanity]

Review responses (5 reviewers: 4 internal + Codex):

Addressed in 3cdacf2:

• Codex P2: Empty Some(serialized empty Rooms) no longer suppresses migration. Now distinguishes "has rooms or tombstones" (authoritative — mark done) from "value present but empty" (placeholder — fire migration). Users with rooms only in legacy delegates are no longer stranded.
• Testing review: Extracted decide_legacy_migration_action() as a pure helper with 5 unit tests covering each (value_present, has_rooms, has_tombstones) case. Locks the gating polarity against future refactors.
• Skeptical M2: fire_legacy_migration_request tightened from pub to pub(crate).
• Big-picture: .claude/rules/river-publish.md updated to reflect the gated flow.

Acknowledged, not changed:

• Code-first concern about mark_legacy_migration_done on corrupt data: reviewer looked at an intermediate diff. The committed code already places the call inside the Ok(loaded_rooms) arm, so corrupt data does not mark migration done.
• Skeptical H1 (cursor-restore from legacy snapshot): pre-existing, separate bug. Filed as Legacy delegate response can overwrite the user's currently-selected room #255.
• Skeptical H2/M3 (timing window + spawn-vs-defer race): same root cause as H1 — the bigger save-after-merge race is pre-existing and out of scope. The data-loss path bug: old delegates overwriting the current active delegate #253 actually reported is closed by this PR; Legacy delegate response can overwrite the user's currently-selected room #255 covers the residual cursor-position concern.

All review verdicts: ready to merge with the fixes above.

[AI-assisted - Claude]