Kernel K4: spaces/ scaffold — a second app proving the kernel seam

[nyblnet]

The payoff PR. Stacked on #38 → #37 → #36 — merge bottom-up.

A real, on-platform second Bento app built entirely on the shared kernel. This
is what the fan-out agents clone as their starting point, so it's a working
reference rather than a stub.

What it is

bento/spaces — Notion/notes-like, deliberately minimal (a flat list of text
blocks) so the kernel seam stays legible. Every kernel module a Bento app needs
is wired:

• configureApp — its own app id, display name (window title + save-picker
  label) and update manifest path. The K2 seam doing exactly its job.
• Self-save (FSA + download fallback, ⌘S), autosave/recovery keyed by
  docId with a restore/discard banner, i18n via a local facade with its
  own catalogs, window.bento AI round-trip.
• Its own model — format: 'bento/spaces', parseDoc that mints a missing
  docId, preserves unknown fields for forward compatibility, and rejects
  other apps' documents. docContentKey stays app-side per PLATFORM §9.
• The shared build pipeline via K3's flags.

Verification — on the BUILT single file, not the dev server

• Boots from a served .bento.html at 9.8 KB, passes the splice
  conformance gate.
• Round-trip proof: edit → serialize() → re-extract #bento-doc →
  re-parse returns the edited content; title persisted, docId stable, runtime
  still compressed, and the file has zero external script/link references.
• Autosave wrote a recovery snapshot through the kernel.
• parseDoc correctly rejects a bento/slides document and garbage.
• Zero console errors.

Notes

• No workspaces — spaces carries its own package.json/lockfile, consistent
  with K1. But with two apps now duplicating vite+typescript, the trigger
  condition the planning audit named is visible; worth revisiting when dash
  lands rather than now.
• CI gains install/typecheck/build/gate steps for spaces, caching on both
  lockfiles.
• Follow-up: docs/PLATFORM.md §9 and docs/PARALLEL-WORK.md §1 should
  name kernel/ and spaces/ as zones — they live on the unmerged Docs: coordination layer for multi-app, multi-agent development #34, so
  I've left them alone to avoid a conflict.
• Collab, encryption UI, rich text and update-checking are deliberately not
  wired; spaces/README.md documents exactly what's stubbed and why.