Phase 008: close the test and CI loop around the migration

Adds the checks that make the constraints from Phase 001-007 mechanical
instead of tribal knowledge, and clears the legacy brand text that was still
reachable at runtime.

New red-line tests:
  - no-legacy-brand mirrors the harness scan under vitest, and asserts its
    allow-list has not drifted from harness-check.mjs
  - hermes-db-readonly classifies every new DatabaseSync call site by
    following the path it opens, and fails if a state.db handle drops
    readOnly. It also pins the one legitimately writable database.
  - i18n-parity compares the raw zh/en locale objects both ways. The
    existing coverage test merged en into zh at import time, so a key
    missing from zh could never fail there.

harness:check gains the four missing gates from the phase brief - retired
package directories, retired package scripts, a single UI library, and the
required root files. Each was verified to fail by mutating the repo.

The online-update channel had hardcoded upstream URLs. It now reads
HERMES_WEB_UI_VERSION_MANIFEST_URL and friends and degrades with a named
error, because a reimplementation has nowhere to pull releases from.

The remaining legacy strings are deliberate and each carries a reason in the
allow-list: the global-agent relay address and the OpenRouter referer are
load-bearing, the socket role identifier is a wire contract, and the pre-rename
DB filenames would orphan existing deployments if changed. AGENTS.md now says
so explicitly, so a future agent does not "clean them up".

Also removes a dead electron mock alias, an i18n exemption that had stopped
exempting anything, and a teardown race in plugins-view.test.ts where a-spin
animation frames outlived the jsdom environment.

Verified self-contained: with reference_code/ moved aside, harness:check,
build, test and test:e2e all pass, so the directory can now be deleted.

docs/harness/worktree-runbook.md

@@ -7,8 +7,8 @@ untouched.
 
 ```bash
 git fetch origin --prune
-git worktree add -b codex/<short-topic> ../worktrees/hermes-web-ui-<short-topic> origin/main
-cd ../worktrees/hermes-web-ui-<short-topic>
+git worktree add -b codex/<short-topic> ../worktrees/hermes-ui-<short-topic> origin/main
+cd ../worktrees/hermes-ui-<short-topic>
 ```
 
 If the repository uses a fork remote, push to the remote requested by the task.
@@ -27,7 +27,7 @@ Use per-worktree state and ports to avoid colliding with a running local app:
 
 ```bash
 export PORT=18648
-export HERMES_WEB_UI_HOME="$PWD/.tmp/hermes-web-ui"
+export HERMES_WEB_UI_HOME="$PWD/.tmp/hermes-ui"
 export HERMES_WEBUI_STATE_DIR="$HERMES_WEB_UI_HOME"
 export UPLOAD_DIR="$PWD/.tmp/uploads"
 npm run dev
@@ -52,7 +52,7 @@ requirements only when the behavior cannot be represented with mocks.
 After a PR is pushed and no more local work is needed:
 
 ```bash
-git worktree remove ../worktrees/hermes-web-ui-<short-topic>
+git worktree remove ../worktrees/hermes-ui-<short-topic>
 ```
 
 Only remove the worktree you created.