visual-artifacts: contract doc audit cleanup

[garagon]

Summary

Self-audit of reference/visual-artifact-contract.md against the shipped code. Doc-only; no behavior change. Closes 6 drift / gap items and improves 4 more.

Closes

ID	Severity	Fix
C-1 / C-7	P3	Exit-code table now covers mktemp failures for HTML temp, manifest temp, and scratch dir (all exit 4 as unsafe-environment signal).
C-3	P3	--latest documents the 30-day max-age window and how to bypass it (pass an explicit <artifact-path>).
C-4	P3	nano_visual_safe_screenshot_path documented as a reserved helper for a future QA-screenshot PR; explicitly NOT wired in v1. Addresses architect's hardening backlog item #1.
C-5	P3	Interactive script body lint contract spelled out (CI greps for absence of each forbidden API + presence of navigator.clipboard.writeText).
C-8	P3	Exit 3 row states aggregate strict mode runs BEFORE --manifest-only early exit, matching the PR 3 pass 3 lock.
C-9	P3	Stack cycle error names every unresolved node in the "Stack invalid" notice.

Clarifies

ID	Topic
C-2	custom/<phase>/ subdir labeled as reserved plumbing (helper exists, no v1 caller passes custom=true).
C-6	Manifest .phase field records the CLI kind (plan/journal/stack), not the stack name. Stack name lives in the synthetic stack:<name> source entry.
C-10	Filename stems are NOT stable across renders (PID + new timestamp every time); consumers needing a "latest" handle should re-render or read the most recent manifest by created_at.

Codex review trail (1 pass, clean)

Pass 1: clean. "The change only updates the visual artifact contract documentation, and the added statements align with the current renderer behavior closely enough that no actionable correctness issues were found."

Test plan

• ci/check-visual-artifact-templates.sh 38/38
• ci/e2e-visual-artifacts.sh 330/330
• visual-artifact-public-copy lint: presence + framing both green
• Codex pass 1 returned clean