feat: add boundaries gallery demo + harden scaffold-sync skill (#848 follow-up)

[vivek7405]

Why

Follow-up to the Next.js 16 file-routing parity work (#848). That PR added forbidden()/unauthorized(), global-error/global-not-found, and nearest-wins not-found, and it updated the scaffold rule files (AGENTS.md/CONVENTIONS.md app-tree bullets) plus the await params gallery demo. But it shipped no gallery demo for the new control-flow throws. The gallery is webjs's primary teaching surface for AI agents, so an undemoed thrower is effectively invisible to an agent scaffolding an app.

The scaffold-sync hook floor passed (the PR did stage scaffold surfaces), so nothing flagged the miss. Root cause: the webjs-scaffold-sync skill had no change-type row for a new control-flow throw / routing boundary file.

What

1. Harden the skill. New change-type row in webjs-scaffold-sync requiring a runnable gallery demo (a route that throws + its nearest boundary file) for any new control-flow throw or boundary file, not just an app-tree bullet. Notes the root-only carve-out.
2. Fill the gap. New app/features/boundaries gallery demo (full-stack + saas):
   • index page teaching notFound/redirect/forbidden/unauthorized + the boundary files;
   • gated/ throws forbidden(), caught by the nearest forbidden.ts (403);
   • private/ throws unauthorized(), caught by the nearest unauthorized.ts (401);
   • root-only global-error/global-not-found taught in prose (cannot mount under a feature folder).
     Cross-linked from the routing demo; added to the home features array, the rule-file feature lists, and scaffold-gallery.test.js.

Verification

• Generated a full-stack app, booted it: /features/boundaries → 200, /features/boundaries/gated → 403 (nearest forbidden.ts), /features/boundaries/private → 401 (nearest unauthorized.ts).
• webjs check: only the expected no-scaffold-placeholder markers, no other violations.
• scaffold-gallery.test.js: 8/8.
• Regression sweep for Close Next.js 16 file-routing parity gaps (async params, forbidden/unauthorized, global-error/not-found, instrumentation) #848 (per the concern about actions/HTTP-verbs/async-render): 59 tests green across await-params, thenable-params, forbidden-unauthorized, page-action, action-verbs, action-config, actions, seed-ssr, action-roundtrip, and async-render SSR. No regressions.

Definition of done

• Tests: added (scaffold-gallery asserts) + regression sweep. Updated.
• Docs: scaffold AGENTS.md + CONVENTIONS.md feature lists. Updated.
• Scaffold: the point of this PR. Updated + generate-boot-check verified.
• Skill: webjs-scaffold-sync hardened.