UI fast-follows from the UI-1 scaffold review

Deferred, tracked items from the UI-1 (#1) code review:

1. **Pinned-vs-live schema drift check.** The freshness test proves the generated client matches the *vendored* schema, not that the vendored schema matches a live engine. Add a low-frequency scheduled Action that fetches conduit's served OpenAPI from a known ref and **opens an issue** on mismatch (cheaper than auto-PR; deciding which conduit ref counts as "live" is the real call). Until then, `SCHEMA_VERSION` + the manual re-vendor path is the mitigation.
2. **Make the Inspect streaming-endpoint exclusion a hard boundary.** Today it's a convention (comment in `client.ts`) + a raw-schema shape test — the generated types for the 3 `/inspect*` paths still exist, so a contributor could call them through the typed client and get the wrong (single-object) type. Tighten before UI-4 consumes the streams (e.g. a narrowed client type omitting those paths, or a no-restricted-syntax lint rule).
3. **Harden the WS frame handler.** `streaming.ts` `JSON.parse(ev.data)` has no try/catch — a malformed frame throws in the message handler. UI-4 owns the streaming consumer (reconnect/backpressure/sampling); fold this in there.

None block the scaffold.

Start by reading the UI-1 review, client.ts, and streaming.ts, then inspect the existing freshness and raw-schema shape tests. Resolve which conduit ref is live, define the boundary for the /inspect* paths, and fold malformed-frame handling into UI-4. Done means the scheduled mismatch check, typed-client exclusion, and safe frame handling are covered without blocking the scaffold.

Written by the indexing model from the issue text.