feat(web-react)!: ChatComposer delegates to canonical AgentComposer

[drewstone]

What

Retire agent-app's bespoke ChatComposer — it's now a thin wrapper over the canonical AgentComposer (@tangle-network/sandbox-ui), so every agent-app surface and sandbox-ui render the one shared input box. ~400 lines of duplicate composer logic deleted; the wrapper preserves ChatComposer's full API (controlled/uncontrolled value, onSend, attachments, streaming Stop, controls slot, Cmd/Ctrl+L focus).

This is the last leg of composer unification: sandbox-ui owns the one design (0.60, now a superset incl. attachments + streaming + a controls slot), the marketing hero + tuner consume it, agent-app re-exports it via /composer, and now agent-app's own web-react composer is it.

Theme bridge (makes agent-app a first-class host for sandbox-ui components)

AgentComposer is authored against the brand MD3 surface tokens; agent-app's theme is shadcn. Added the md3 → shadcn mapping to agent-app's own theme so the shared composer renders on-palette in any shell using @tangle-network/agent-app/styles:

• tokens.css: --md3-outline-variant / --accent-surface-soft / --accent-text / --status-error / --radius-md → the shadcn triples (light + dark via cascade).
• tailwind-preset: surface-container / -high / -highest → card / popover / secondary.

⚠️ BREAKING (minor bump 0.42 → 0.43, gated off ^0.42)

Consumers of the web-react UI must:

1. Provide the now-needed (optional) peers: @tangle-network/sandbox-ui >=0.60, @tangle-network/brand >=0.6, @xyflow/react >=12.
2. Add sandbox-ui's dist to their Tailwind content/@source so the composer's classes generate (see the playground config change).
3. Note: the send control is now an icon button (accessible name 'Send', was 'Send message'); controlsPlacement no longer moves controls above the input.

Proof

• web-react suite 31/31; tsc; ESM + DTS build green.
• Verified in the playground (a real file:.. consumer): ChatComposer renders fully styled via AgentComposer in agent-app's light theme — bridge resolves surface/border/primary correctly, controls slot (the playground's model pill) intact.

Not in scope

The other duplicate pickers (AgentSessionControls / ModelPicker / EffortPicker / ProviderLogo in web-react) still exist and keep their flat APIs — a separate follow-up (and ProviderLogo would first need exporting from sandbox-ui).

[tangletools]

✅ Auto-approved drewstone PR — 62818813

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-06-30T01:47:19Z}