feat: integrate the 0.4.6 line (R20, F1-F5, F7, F8)

[owjs3901]

Lands owjs3901/integration-0-4-6 on main. It was the base of #48 and had never passed CI on its own.

What is in it

• R20 — audits what still stands between the generator and a browser-measured claim, naming each remaining approximation instead of leaving the gap implicit.
• F1–F5, F7 — responsive and project-context corrections: prevalidating a responsive export before projection, discovering breakpoint widths from the frames rather than assuming them, reconciling exported tokens against the theme a project already has, categorising token suggestions so an unmatched value is not advised toward a token that does not exist, budgeting a Section preview so a large selection cannot exhaust the projection, covering FILL layout where it was approximated, and reporting a typography token the validator had never checked.
• F8 — teaches devup-ui semantics to the caller and delivers skills through the CLI.

What I fixed to make it mergeable

Ten rustfmt violations. This branch had never been green; those ten are why every verify job on #48 failed in under a minute. They are fixed here rather than carried further. (They were also what made #48's CI look like the bridge's fault — it wasn't.)

One conflict, in crates/devup-mcp/Cargo.toml: a comment block main carries and the incoming commit does not. Kept main's.

A changepack, for the 18 changed crate files.

The new bundle gate earned its keep immediately

This branch changes explore.js and section_index.js, and those scripts are compiled into the bridge plugin at build time. So plugin/dist/ was stale the moment these commits landed on top of #50 — and the gate added in #50 caught it on the first run:

bundle gate: 1

Rebuilt and committed. Gate now clean. That is exactly the drift the gate exists to prevent, on its first real opportunity.

Verification

Gate	Result
cargo fmt --all -- --check	0
cargo clippy --locked --workspace --all-targets --all-features -D warnings	0
cargo test --workspace	1112 passed / 0 failed / 2 ignored (main is 1090; +22)
cargo insta test --check	no drift
cargo test --locked -p devup-mcp --test stdio_smoke	2 passed
cargo metadata --locked	0
plugin bundle rebuild + diff	0

Harness: no regression. All 14 measurable screens are identical to main's thresholds — popup 3.64 / 2.06 / 0.85, keyframes 2.69, grid 2.96, notice 3.74 / 2.12 / 1.16, about 5.43 / 2.93 / 1.77, landing 4.78 / 2.47 / 1.50.

One pre-existing condition, not caused by this branch

report-446-1971 no longer acquires: the Figma file changed upstream, so the cached call returns DEVUP_FIGMA_VERSION_CHANGED. I verified this against a binary built from main — it skips identically. Unrelated to these commits.

Two things worth noting about how that surfaced: the acquisition skipped the screen and carried on instead of dying with a traceback, and the run still exits non-zero so a skipped screen cannot pass unnoticed. Both are the harness-determinism work behaving as designed. The screen needs re-acquisition against the current file, which is separate work.