fix: capture deep editable components

[chubes4]

Summary

• capture only deep, safe, repeatable content components after native recognizers decline
• preserve runtime descendant contracts and source provenance on generated component references
• collapse unstyled source-projected group chains into an editable layout-shell companion while retaining wrapper DOM and ordered native children
• leave styled wrapper chains to core serialization, preventing React save normalization from invalidating blocks
• use a project-local Composer cache during Codebox transformer-overlay hydration
• apply the full fallback URL sanitization policy to generated component HTML

Validation

• php tests/unit/custom-block-generator.php (54 assertions): passed
• composer test:unit: passed
• Solved-only local promotion matrix: passed with both fixtures as solved_candidate, 0 findings, 0 failed fixtures, valid editor blocks, and exact visual parity.
• composer test:canonical: fails only at the inherited Figma template-surface assertion in tests/contract/template-surfaces.php:104, after the preceding HTML-to-block and site-plan contracts pass.
• Baseline proof: detached origin/trunk at b149f9fd6122f397268f6a6a1225b01ff24c321c fails the exact same assertion and message. The test file is byte-identical to trunk (sha256:09c486ae2c094e8504bad7b6969de50def4b43a35adcb515252e028acc3422e5).

Scope

Related to #1060. Runtime plan projection remains separately owned by #1104; this PR preserves runtime descendant provenance but does not implement that projection.

AI assistance: OpenAI GPT-5.6 Sol via OpenCode reviewed, completed, and verified the deep component editability repair. Chris Huber remains responsible for every line.