Confirm demolition of the intended building before applying it

“Tear down” currently destroys the selected building and saves that change immediately, without a confirmation. This differs from the preserved manual's building options, which documents an explicit yes/no step before demolition.

Reproduced through normal production-browser input on the current game:

1. Start a fresh settlement and pause.
2. Choose Woodcutter's hut and press Enter to place its site. The inspector names the site and the settlement shows two buildings.
3. Click Tear down.
4. The count falls to one building, the inspector disappears, and the dispatch reports a saved settlement. No visible confirmation dialog appears. The browser regression fails while recording no console, request or collection errors.

Source owner: resources/views/index.stx and the public controller demolition action. Related #35 and the maintained dialog delivery in #224. Manual revision 8426388935b436e65b0697ac401c4247ab097364; original file SHA-256 10dcbad8d7c02a7873b263f1db81e7561368467f429c4b6b6113758122d65a9e was reverified.

Acceptance:

• Retain a real production-browser regression that checks a visible, named confirmation and preservation of the selected building before confirmation.
• Use the maintained dialog primitives with a safe initial focus, contained keyboard navigation, Escape/backdrop/cancel behavior and correct focus restoration.
• Capture the intended building identity. Confirming a stale target must not demolish a different selected building; validate current ownership and existence through the real command path.
• Confirm exactly once and preserve actual goods, workers, accounting, dispatch and checkpoint behavior. Exercise both unfinished sites and completed buildings, plus cancellation and stale-target failure.
• Verify narrow and short screens, source lint/types/units, full production browser acceptance and pushed CI diagnostics before closing.

This corrects the documented interface workflow. It does not settle original unfinished-site refunds or Gold timing, which remain with #35 and the observation work. Do not add raw document/window access to the STX script or copy a focus runtime into the application.

Shipped with the 'interface step' above; CI diagnostics follow on the pushed run.

The original-manual confirmation is implemented locally, with a captured building target and a one-use order. Four application regressions cover completed and unfinished buildings, cancellation, stale targets, replacement sessions and duplicate confirmation; the full 434-test unit suite passes. Goods and people remain on the existing engine accounting path.

Production Chrome testing also exposed an owning compiler defect: a plain-script DialogPanel captures caller slot events into its local script, so clicking the safe action throws an undefined-handler error. The standalone regression and source correction are tracked in stacksjs/stx#2126. Game acceptance remains open until that correction is released, verified, adopted through Stacks and exercised here. No template workaround is being used.

The owning STX event-scope correction is published in 0.2.720 and adopted through the verified Stacks 0.75.329 release. The game uses the normal upgrade and original installed files.

The production-browser check now passes 117 steps across 1280x720, short 812x375 at 2x, and narrow 320x568. It covers the safe initial action, keyboard containment, all cancellation routes, correct target confirmation, sites and completed workplaces, and actual checkpoint reload. The real ownership-capture unit regression also passes: a tower captured while confirmation is open cannot be demolished by its former owner.

All 438 unit tests pass. The complete browser gate and pushed CI are still pending. Original unfinished-site refund and Gold timing remain with #35.

The full browser gate found a separate regression in the existing restart dialog: an invalid map seed shows its error, but focus remains on the submit button. The demolition dialog's 117 focused checks and the unchanged ten-minute rival battle passed before that failure.

The failure reproduces in a standalone upstream Chrome test and is tracked in stacksjs/stx#2127. STX rendered the inner panel first, then retained its ref receiver when projecting that markup through the outer Dialog. The compiler correction forwards that caller boundary while preserving child-owned refs. The regression also covers an aliased accessor with the same ref name as the Dialog's own local ref, repeated openings, cancellation, confirmation and restored opener focus.

Focused checks, types and normal STX release preflight pass. The full source suite and published-package adoption still need to finish before rerunning the complete game gate. This issue remains open.