Merge origin/master into worktree/web-plugin-config, adapting to ctx.remote.$on

#2201 landed three moves this branch sits on top of. `bindSettingsScope` became
`ctx.settingsScope.bind` on the Settings surface, so the section injects that
service and the Remote face instead of importing a free function; the
`SettingsScope` types moved into the runtime contract module, which is where
this branch's `base`, `user`, and `unset` now live; and the client
`credentials/changed` event became the forwarded owner event
`credentials/updated`, which the web-search card subscribes to through
`ctx.remote.$on`.

The generated module graph crossed mermaid's 1000-edge render guard with this
branch's 14 new edges. The guard doubles again, exactly as it did at 500 — the
graph counts real package edges, and trimming them to fit a renderer default
would make the document lie about the dependency set.

packages/client/test-runtime/tests/remote.spec.ts

@@ -0,0 +1,43 @@
+/**
+ * TestRemote's own contract: subscription and disposal, dispatch driven by the
+ * internal plumbing event, the silent drop for an unsubscribed name, and the
+ * `$mount` refusal that sends a spec to the real Client Remote service.
+ */
+import { Context } from '@deepseek-ai/cordis'
+import { describe, expect, it } from 'vitest'
+import { TestRemote } from '../src/remote.ts'
+
+describe('TestRemote', () => {
+  it('delivers a forwarded event to its subscribers and stops after disposal', async () => {
+    const ctx = new Context()
+    const remote = new TestRemote(ctx)
+    const seen: string[] = []
+    const off = remote.$on('settings/document-updated', (ns: string) => {
+      seen.push(ns)
+    })
+
+    ctx.remote.$dispatch('settings/document-updated', ['ui-theme', 1])
+    expect(seen).toEqual(['ui-theme'])
+
+    off()
+    ctx.remote.$dispatch('settings/document-updated', ['ui-theme', 2])
+    expect(seen).toEqual(['ui-theme'])
+    await ctx.fiber.dispose()
+  })
+
+  it('drops a forwarded event nobody subscribed to', async () => {
+    const ctx = new Context()
+    new TestRemote(ctx)
+    // No subscriber for this name: the emit must be inert rather than throwing,
+    // because the wire carries whatever the Host allowlist selected.
+    expect(() => { ctx.remote.$dispatch('credentials/updated', ['DEEPSEEK_API_KEY']) }).not.toThrow()
+    await ctx.fiber.dispose()
+  })
+
+  it('refuses $mount, which needs the real Client Remote service', async () => {
+    const ctx = new Context()
+    const remote = new TestRemote(ctx)
+    await expect(remote.$mount()).rejects.toThrow('needs the real Client Remote service')
+    await ctx.fiber.dispose()
+  })
+})