Steps 6.4-6.7B — Local surfaces, reference-exhibit validation, SciFi Observation surface

One commit for the work accumulated in the working tree since Step 6.3,
which had never been split into per-step commits:

- src/local-surfaces.js + src/surface-url.js (new); src/ui.js,
  src/validation.js, src/connection.js and public/index.html updated for
  local-surface hosting and generic surface rendering
- tests: local-surfaces (20), scifi-surfaces (24) and postmessage-interop (7)
  new; connection/museum-gallery/surface-validation suites updated
- reference exhibits: shared/contract-core.js defaults to Contract 5.3
  (major 5, minor 3, xzbt 5.3); museum-gallery advertises its surface
  catalog; aquarium/haunted-house/planetarium adapters updated
- SciFi-XZBT (Step 6.7A/6.7B): surface-mode.js + surface-bus.js,
  Observation-surface boot branch, local-change hooks, view.pillars /
  view.warp-flight targets; fixture byte-identical to G:/.vibe/SciFi-XZBT
- SciFi-XZBT contract adapter handshake fix: the inbound bridge filter no
  longer gates on an exact advisory xzbt value (Contract 5.3 §6.5), only on
  its presence/type, matching the host's own envelope validation; the
  adapter now advertises contract minor 3 / version 5.3.0, which it already
  implemented via the 5.3 surfaces field. Root cause of the five failing
  postmessage-interop tests (host hello was silently dropped).
- docs: architecture 6.4 and 6.7A, reference 6.6 and 6.7; evidence logs;
  test-fixtures/PROVENANCE.md resync record

Test results: NGN 154/154 (was 149/154); postmessage-interop 7/7 (was 2/7);
SciFi contract harness 21/21, real-adapter suite 32/32. git diff --check
clean for changed files; two pre-existing trailing-whitespace lines remain
in test-fixtures/reference-exhibits/scifi/index.html, copied verbatim from
the authoritative SciFi source.

Step 6.7 live verification (browser Observation, packaged standalone) is
still pending and is not claimed here.

tests/surface-validation.test.js

@@ -1,9 +1,14 @@
 /**
  * Phase 6.3 — Surface catalog validation and lifecycle tests.
  *
- * Covers Contract 5.3 §§31.2-31.5 normative validation order,
- * host state lifecycle, registry refresh behavior, and 5.2 backward
- * compatibility.  No exhibit-specific IDs appear in this file.
+ * Covers Contract 5.3 §§31.2-31.5 normative validation order, host state
+ * lifecycle, registry refresh behavior, and the host's protocol-level
+ * ability to negotiate with a genuine Contract 5.2 peer (Contract §28.2).
+ * That is a property of NGN's own negotiation logic against whatever a peer
+ * reports, using synthetic peer fixtures below -- distinct from, and not an
+ * argument for, keeping any of this repository's own maintained reference
+ * exhibits pinned to Contract 5.2. No exhibit-specific IDs appear in this
+ * file.
  */
 import test from 'node:test';
 import assert from 'node:assert/strict';