feat: adopt host Action for Kandy top bar

[carlosflorencio]

Change

Kandy uses Kandev's host-owned ui.Action in the chat top bar when that API is available. The Action owns the control shell; Kandy's decorative creature SVG is sized to the host's 16px glyph box. The existing preview, dialog, animation state, reduced-motion behavior, data refresh, and lifecycle remain intact. Older supported hosts use the legacy native button.

The Action's accessible label now uses the host plugin-translation catalog, with an English fallback. Level, stage, mood, and sleep state remain in the label.

Compatibility and pins

• Runtime minimum remains Kandev 0.83.0; plugin ID, registration slot, manifest version, configuration, permissions, and state are unchanged.
• .kandev-sdk-ref pins the source API contract to 570600439036e81f8e9e1c63f15c4abce8a6c846, containing merged Kandev PR #3943.
• Action is feature-detected. The v0.83.0 host does not provide Action and exercises the native-button fallback.
• Existing prerelease tag/version validation remains intact.

Verification

• make check-format vet test passed: Go tests, 98 UI tests, and positive/negative package and release verifier checks.
• TMPDIR=<short task-owned cache directory> make build package-host package passed. The package verifier checked the host package and all five declared platform binaries, UI assets, manifest, exact inventory, and SHA-256 checksums.
• Installed kandev-plugin-kandy-0.14.0.tar.gz in an isolated built Kandev host at 570600439036e81f8e9e1c63f15c4abce8a6c846; the Action path passed.
• Installed the same package in an isolated v0.83.0 host at 9a3f2242242bd50feb8bc0784d51e8d81c9d85d9; the legacy path passed.
• Both real-host runs covered desktop hover/focus preview, Enter and Space activation, dialog open/close, reduced motion, phone touch activation, and disable/re-enable with exactly one widget after re-enable. Phone targets measured 44×44; Action artwork/glyph measured 16×16, and fallback artwork measured 22×22. The Action desktop shell measured 28×28.
• Reproduce with node scripts/smoke-real-host.mjs <host-root> kandev-plugin-kandy-0.14.0.tar.gz <action|legacy> <port> <artifacts-dir>. README documents locked dependency setup and host revisions. JSON measurements, host logs, and screenshots are retained in the task workspace at real-hosts/artifacts/action and real-hosts/artifacts/min-host.
• GitHub CI run 36346934224 and all-platform Build run 36346934198 both completed successfully.

Limitations and overlap

The pinned source host is not a stable Kandev release. The Action path still requires validation against a stable release containing PR #3943 before this package can be merged. Existing overlapping PRs #20, #11, and #21 were left untouched.

Release hold: do not merge until a stable Kandev release includes PR #3943 and this package has been validated against that release.