Replace raw Rsbuild HMR frames with a provider-owned Runtime App reload channel #73

Follow-up to the Rsbuild conformance audit: #72.

Problem

RuntimeClientSurfaceProxy opens a raw WebSocket to Rsbuild and parses text JSON with a top-level type. Rsbuild publicly documents token acquisition, dev.client.path, and Environment.hot.send('full-reload'); it does not stabilize the serialized server-message envelope, hash / ok ordering, heartbeat behavior, or raw-client obligations. A minor upgrade can leave the socket connected and health counters green while Runtime App refresh silently stops.

The bounded conformance fix allowlists only the provider-emitted full-reload kind and ignores private/unknown kinds. That removes the current semantic error but does not make the raw envelope public.

Proposed direction

• Emit a provider-owned reload event from the successful, changed App environment compile hook.
• Carry that event through a provider/runtime-session-owned channel to the Runtime App outer relay.
• Keep Rsbuild WebSockets only for Rsbuild's shipped HMR client, not as an application protocol.
• Preserve current reconnect, teardown, payload-bound, and stale-refresh protections.

Acceptance

• Runtime App reload behavior has no dependency on Rsbuild internal frame names or payload shape.
• A changed App compilation refreshes once; RSC/widget-only and unchanged App compilations do not refresh.
• HMR E2E covers connection loss/recovery and upgrade-frame changes without inspecting private Rsbuild messages.