Steps 6.4-6.7B — Local surfaces, reference-exhibit validation, SciFi Observation surface

One commit for the work accumulated in the working tree since Step 6.3,
which had never been split into per-step commits:

- src/local-surfaces.js + src/surface-url.js (new); src/ui.js,
  src/validation.js, src/connection.js and public/index.html updated for
  local-surface hosting and generic surface rendering
- tests: local-surfaces (20), scifi-surfaces (24) and postmessage-interop (7)
  new; connection/museum-gallery/surface-validation suites updated
- reference exhibits: shared/contract-core.js defaults to Contract 5.3
  (major 5, minor 3, xzbt 5.3); museum-gallery advertises its surface
  catalog; aquarium/haunted-house/planetarium adapters updated
- SciFi-XZBT (Step 6.7A/6.7B): surface-mode.js + surface-bus.js,
  Observation-surface boot branch, local-change hooks, view.pillars /
  view.warp-flight targets; fixture byte-identical to G:/.vibe/SciFi-XZBT
- SciFi-XZBT contract adapter handshake fix: the inbound bridge filter no
  longer gates on an exact advisory xzbt value (Contract 5.3 §6.5), only on
  its presence/type, matching the host's own envelope validation; the
  adapter now advertises contract minor 3 / version 5.3.0, which it already
  implemented via the 5.3 surfaces field. Root cause of the five failing
  postmessage-interop tests (host hello was silently dropped).
- docs: architecture 6.4 and 6.7A, reference 6.6 and 6.7; evidence logs;
  test-fixtures/PROVENANCE.md resync record

Test results: NGN 154/154 (was 149/154); postmessage-interop 7/7 (was 2/7);
SciFi contract harness 21/21, real-adapter suite 32/32. git diff --check
clean for changed files; two pre-existing trailing-whitespace lines remain
in test-fixtures/reference-exhibits/scifi/index.html, copied verbatim from
the authoritative SciFi source.

Step 6.7 live verification (browser Observation, packaged standalone) is
still pending and is not claimed here.

test-fixtures/reference-exhibits/shared/host-transport.js

@@ -1,5 +1,5 @@
 /*
- * XZBT Exhibit Contract 5.2 — same-origin postMessage host transport.
+ * XZBT Exhibit Contract 5.3 — same-origin postMessage host transport.
  *
  * This is layer 6 of the Authoring Guide's recommended separation, and it is
  * deliberately the thinnest file in the project. It knows how to move
@@ -61,7 +61,15 @@
 
     var message = event.data;
     if (!message || typeof message !== 'object') return;
-    if (message.xzbt !== window.XZBTContractCore.VERSION) return;
+    /* `xzbt` is advisory metadata, not a version gate (Contract §6.5): real
+     * compatibility is negotiated by ContractCore.handleRequest/handleHello
+     * via contract major/minor, not by string-matching the caller's
+     * advisory tag against this exhibit's own static module version here.
+     * (This used to compare against window.XZBTContractCore.VERSION, the
+     * shared module's fixed default -- never the per-instance version an
+     * exhibit actually negotiates -- so it silently discarded every
+     * message from any host whose advisory tag didn't happen to equal
+     * that hardcoded default, including well-formed hellos.) */
 
     /* Source is assigned here, at the trusted receiving boundary. */
     var response = this.core.handleRequest(message, 'host');