fix(artifacts): address the PR 109 review findings

[bryantderosier]

The artifact review on #109 left a few findings I carried on my crews branch; this PR is only those, so they can be reviewed on their own.

The artifact change subscription moves out of upstream's WebSocket method table into a J5 RPC group merged beside the persona group, with its scopes and handlers spread from J5-owned modules, which keeps another upstream method off the shared table. The artifact HTTP route reports not-found through a typed reason instead of matching an error string. The Artifacts page now holds its own environment connection, waits for it before fetching, and re-reads a preview only when that file changed or I press Refresh. Listing sorts before it truncates and keeps the size guard that fails fast on an absurd directory. FORK.md case 33 describes what actually exists.

Built with Claude Fable 5.1 in Claude Code.

🤖 Generated with Claude Code

Closes #201.

[Jacksondr5]

Reviewed with a second independent pass (GPT-6-Astra); the two of us converged on the same list. The transport split itself is right: the cheap change notification rides the socket, the file bodies ride HTTP, and the J5 RPC group is a genuine reduction over the inline handler it replaces. The upstream touch points are one import plus one additive entry each, which is fine.

Blocking: apps/web/src/j5/artifacts/artifactClient.ts hand-rolls HTTP auth and has no relay refresh-and-retry.

The DPoP branch signs a proof with whatever token the prepared connection already holds. On a T3 Connect connection the relay token expires without closing the socket, so the artifact change stream keeps flowing while every list and read returns 401, including on Refresh. Direct, Tailscale, and SSH are unaffected because those use cookies or a static bearer token. This predates this PR, but this is the PR that rewrote the page's connection handling and case 33, and case 34 already records that J5 reads go through the shared authenticated transport. executeJ5Request in packages/client-runtime/src/j5/http.ts (built on executeAuthenticatedEnvironmentHttpRequest) resolves the token at request time and refreshes once on rejection; routing the two artifact requests through it should be a small change and would let this client drop its own bearer/DPoP branches.

Fix before merge: the preview still re-reads on every directory change (inline comment on ArtifactsPage.tsx).

Comment: the page tests assert source strings and could not have caught the above (inline comment on the test).

Reviewed by Claude Fable 5.1 in Claude Code, with an independent pass by GPT-6-Astra in Codex.

[bryantderosier]

Both fixes are in 931b9ba05. The artifact client now goes through executeJ5Request, so the credential is resolved per request and a rejected relay token is refreshed once; the local bearer and DPoP branches are gone. The preview re-reads only when its own file changes or I press Refresh, with the revision computation extracted and tested directly. The stack is rebased onto main with #144 underneath it.

[Jacksondr5]

Verified the fix at 931b9ba05. Approving.

Reviewed by Claude Fable 5.1 in Claude Code.