fix: service-worker root assets (#830) + all tic-tac-toe dogfood findings (#837)

[vivek7405]

Fixes the service-worker path bug and every finding from the tic-tac-toe dogfood session.

Closes #830
Closes #837

#830: service-worker root assets serve at the site root

A worker registered at /sw.js scopes to the origin root, but the scaffold served public/* only at /public/*, so GET /sw.js was a 404 and the app/features/service-worker gallery demo could never register.

• packages/server/src/dev.js: the shared static branch now remaps /sw.js and /offline.html to public/ and adds Service-Worker-Allowed: /. One place (the runtime-agnostic handler), so it covers dev, prod, Node, and Bun.
• Tests: packages/server/test/dev/root-assets.test.js + a Bun parity proof test/bun/sw-root-assets.mjs (green on node 26 AND bun 1.3.14).
• Docs reconciled: root AGENTS.md, agent-docs/service-worker.md, the scaffold AGENTS.md, and the gallery demo.

#837: all 7 dogfood findings

1. Redirect footgun (307 vs 303). The forms demo now warns: RETURN { redirect } (303 PRG); do NOT THROW redirect() from a page action (a 307 that re-POSTs and re-runs the mutation, the phantom-move bug).
2. Component browser test. A co-located modules/components/components/browser/counter-card.test.js teaches the real idioms (suite/test, ssrFixture, inline assert, no chai); the WTR glob now discovers co-located **/browser/** tests. Verified passing in real Chromium (3/3).
3. Drizzle reads. The todo query names both equivalent read styles (relational db.query vs core db.select().where(eq())).
4. MCP source tool "no matches". grepSources no longer returns a misleading "no matches" when ZERO packages resolved (nothing was searched), and a genuine no-match now discloses the searched scope so absence is trustworthy. packages/mcp/test/mcp-source.test.mjs covers empty-roots, scope disclosure, and a cross-package (server src) find.
5. Drizzle rc pin. The generated drizzle-orm / drizzle-kit are pinned EXACTLY to 1.0.0-rc.3 (the tested relations-v2 API), not ^, so a scaffold no longer drifts to a newer rc.
6. Install crispness. Getting-started now leads with npm create webjs@latest my-app (no global install) and warns that a global/shimmed webjs can shadow the CLI.
7. Browser-test prereq. The hello browser-test header notes the one-time npx playwright install chromium and the tdd-UI idioms.

Verification

Generated full-stack + saas + api; webjs check clean (only intended placeholder markers); co-located browser test green in Chromium; #830 server tests green on Node and Bun; the 12 MCP source tests pass. No published-package version bump in this PR.

https://claude.ai/code/session_01EM2Bdq3we9kmJzMw88P4q6