refactor(gui): read the typed projections block off the history response

The wire type now carries projections?: SessionProjectionsBlock (host-base
landed), so the structural projectionsOf narrowing and its TODO(gui) go away —
Session reads result.value.projections directly at all three installWindow
sites. ProjectionsBaseline stays as the cell framework's structural twin
(React-free layer keeps depending on the type table only) with values typed
Partial<SessionProjectionMap>; the erased walk moves inside resetBaseline
where per-key typing is re-established by schema.parse.

packages/client/runtime/tests/projection-cell.spec.ts

@@ -95,7 +95,9 @@ describe('ProjectionCellSet semantics', () => {
 
   it('degrades a baseline payload failing schema validation to absent instead of poisoning the cell', () => {
     const { set, cell } = bench()
-    set.resetBaseline({ asOfSeq: 10, values: { 'test/marks': 'not-an-object' } })
+    // Deliberately malformed wire payload: the typed block cannot express it,
+    // which is exactly why the boundary schema exists.
+    set.resetBaseline({ asOfSeq: 10, values: { 'test/marks': 'not-an-object' as never } })
     expect(cell.getSnapshot()).toBeUndefined()
     // The watermark still advanced to the cut: pre-cut events stay dropped.
     set.offerEvent(markEvent(8, ['pre-cut']))