[P3][UI-05] Generated custom components and applications

Programme: #1
Epic: #19

## Objective
Allow the browser's coding harness to create missing UI/application functionality without promoting generated code directly into the trusted shell.

## Scope
- Detect when trusted declarative components cannot satisfy a requested experience.
- Generate extension source in an isolated coding workspace.
- Static checks, dependency review, unit/integration/accessibility tests and preview.
- Explicit manifest with files/network/capability/resource requests.
- Human review of code/diff and permission delta before installation.
- Signed package creation, versioning, migration and rollback.
- Runtime execution through SDK-01 sandboxed extension host.

## Security rules
- Generated code never runs in the trusted shell process.
- New/wider permissions always require a new review/grant.
- Build tools/dependencies have scoped network/filesystem access.
- Self-modification of policy/supervisor/security code is prohibited outside normal reviewed development flow.

## Acceptance criteria
- [ ] Generated extension is built/tested in isolation before preview/install.
- [ ] Permission manifest exactly describes runtime host imports/capabilities.
- [ ] Extension cannot mutate trusted shell/policy code or obtain undeclared egress/files.
- [ ] Update requesting greater authority stops for explicit review.
- [ ] Failed extension can be disabled/rolled back without corrupting workspace state.
- [ ] Accessibility and resource-limit tests gate installation.

## Dependencies
- UI-01
- CODE-01
- SEC-04
- SDK-01

**First phase:** P3
**Maturity target:** P5
**Owner:** workspace-ui-data

## Task issues
- [ ] #431 `UI-05.T01` — Detect a genuine catalogue gap and specify the extension
- [ ] #432 `UI-05.T02` — Create a confined coding workspace
- [ ] #433 `UI-05.T03` — Generate source, manifest and tests
- [ ] #434 `UI-05.T04` — Run independent build and security checks
- [ ] #435 `UI-05.T05` — Provide a nonproduction preview
- [ ] #436 `UI-05.T06` — Review permission delta and install signed package
- [ ] #437 `UI-05.T07` — Implement extension update and rollback
- [ ] #438 `UI-05.T08` — Qualify a complete generated-app journey

Start with the objective, security rules, acceptance criteria, and dependencies UI-01, CODE-01, SEC-04, and SDK-01. The work is decomposed into task issues #431–#438, from identifying a catalogue gap through rollback and journey qualification. Done means the stated isolation, permission-review, accessibility, resource-limit, installation, and rollback criteria are satisfied.

Written by the indexing model from the issue text.