S00-002: Propose a pinned React stack with a reproducible rendering spike

Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review.
Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed.

Task: S00-002
Agent: auto-orchestrator-68a05c587e33
Role: orchestrator
Action: claim
Status: review

Task title: Выбрать framework и build runtime

experiments/0001-stack/README.md

@@ -0,0 +1,45 @@
+# S00-002 rendering spike
+
+One local React/TypeScript/Vite experiment for ADR 0001. The registry-access/
+subdirectory belongs to the reviewed S00-011 probe and is retained unchanged.
+No account, network messaging, crypto, media, service worker or application
+scaffold is implemented here.
+
+## Reproduce
+
+Use Node **24.21.0** with bundled npm **11.19.0**. `.nvmrc` is a pin for an
+existing version manager; installing the spike never changes system runtimes.
+Official binaries: https://nodejs.org/dist/v24.21.0/ — verify the selected archive
+against SHASUMS256.txt with normal TLS trust. On this executor, the verified
+macOS ARM64 runtime was unpacked at
+`/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64`.
+
+From this directory with the pinned runtime's bin directory first on PATH:
+
+```sh
+node --version
+npm --version
+npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-review-cache --fetch-retries=0 --fetch-timeout=15000
+npm run build
+npm run preview -- --port 4173 --strictPort
+```
+
+Use a new cache path for a network/clean-cache check. npm ci itself removes old
+node_modules and fails on lock/manifest mismatch. Keep optional platform packages
+enabled; TypeScript/Vite use platform binaries and build succeeds without
+lifecycle scripts. TLS verification and exact engine checks remain enabled.
+The private package is not published. npm install is only for explicitly reviewed
+lockfile updates, not normal reproduction.
+
+Open `http://127.0.0.1:4173` locally: expect “Luma rendering spike” and “Count: 0”.
+Click Increment twice: expect Count: 2. This is the manual DOM/interaction check;
+it was **not run** because this harness exposes no browsers. Build/typechecking
+were run successfully. Stop the server with Ctrl-C. `npm run dev` is available
+for source development; no React refresh plugin is installed.
+
+Build output/node_modules are ignored. The browser bundle is static and requires
+no Node server. Explicit compiler floors: Chrome/Edge 111, Firefox 114, Safari
+16.4, with no API polyfills; the product browser matrix is a later decision.
+Preserve THIRD_PARTY_NOTICES.md when distributing this bundle; full lock graph
+licenses are in LICENSE_INVENTORY.md. CI, release notice automation, app tests
+and cryptographic/protocol compatibility remain subsequent tasks.