feat: import LAS surfaces and consume maintained source releases

Summary

Import declared LAS 1.2 point formats 0-3 into bounded mean-cell stockpile surfaces through the public library and native volumes:import --format las command. Retain source/declaration bytes, cell counts/spread and an explicit metre/up vertical-reference audit. Reject incompatible embedded vertical CRS values and keep filesystem diagnostics private.

owned LAS bytes + closed gridding declaration
  -> strict projected-unit and vertical-axis admission
  -> explicit selection, cell means and null gaps
  -> source-bound volume dataset, manifest and replay

Fix workspace rendering by naming client reports explicitly, preventing interpolation from calling the server-global error reporter. Genuine server reporting remains enabled; general evaluator isolation is tracked in stacksjs/stx#2119.

Replace both dependency patches with maintained source releases: BunPress 0.2.25 and the explicitly owned @stacksjs/tuf-js 6.0.1 client. The existing tuf-js import key resolves to the immutable SDK release, locked by SHA512. Preserve MIT attribution and the verified-persistence, clock ownership and typed error behavior. Document the source-release rule in application guidance. Closes #108.

Evidence

• Genuine failing/passing regressions cover vertical CRS compatibility, private file diagnostics and native rendering with the actual server reporter. On the prior combined source, 230 focused tests and 13 copied LAS cases pass; four existing outputs remain byte-identical. Real browser volume, diagnostics and application workflows pass.
• Installed SDK 19/19 and BunPress 88/88 files match published source archives. Native forced frozen install passes. Released-boundary SDK/store/enrollment/preparation/candidate checks: 69 tests, 453 assertions, zero failures.
• Six copied executable campaigns pass: four SDK operational-error outcomes and 3/4/8/11/20 staging/trust/store/preparation/candidate operations. Actual retained format-1 executable compatibility passes without file mutation. Nine real process-interruption cuts pass. Callback interruption is recorded separately.
• Buddy lint, application/runtime/view types, native CLI and docs builds pass. Docs audit: 101 pages, 411 search destinations, 8,038 local links and 101 assets, zero failures. Actual desktop/320 px keyboard and pointer search checks pass without overflow or console errors. Both independent review axes are clean.
• Exact final CI 40125407306 passes all five jobs on cdc79ddb55e280b703c0fa227240f5cec4a7421e: 2,174 pass, 41 skip, zero fail and 522,994 assertions across 2,215 tests in 248 files. All compiled commands and both browser jobs pass. Skips remain unexecuted evidence. Original logs and selected host-slot, maintenance and LAS artifacts are retained and independently read back.
• CI candidate qualification runs 18 operations without a retained older binary; the separate local 20-operation campaign uses the actual format-1-only predecessor. Full local suite admission was denied below 4 GB; focused local checks are not claimed as a full local pass. Original failed inputs and receipts remain retained.

Merge Danger

Door: Two-way for source dependency integration and additive volume processing. Keep existing persistent-format and rollback safeguards when changing versions.

Blast Radius: Volume processing, workspace rendering, documentation and the update coordinator dependency boundary. The maintained SDK is an owned fork, not an unmodified upstream release. Cell areas are modeled; physical accuracy remains unverified. No LAZ, reprojection, datum transformation, physical acquisition or hardware firmware deployment is claimed. Broader survey acceptance in #19 remains open. Outputs remain inhibited; local browser qualification does not establish Drone production deployment.