fix: harden app-builder verification and production builds

[iamjr15]

Summary

• make browser action inputs strict and method-specific so models cannot emit incomplete actions
• preserve React and React Native architecture when browser automation itself fails
• replace the split runtime-generated Next scaffold with one immutable, fully buildable template
• prove every sandbox snapshot can complete a real native-mirror production build

Architecture

The sandbox image now owns the entire Next scaffold, including TypeScript and PostCSS configuration. AgentRun customizes only the request-specific page. Runtime dependencies remain an immutable linked tree, and package resolution follows that normal node_modules boundary for previews, typechecking, and builds.

Browser tool schemas describe complete action variants at the model boundary. Runtime validation remains authoritative for every provider, while supported providers also receive strict function schemas.

Decisions Made

Decision	Choice	Reasoning
Next production builder	Explicit webpack opt-in	Native project mirrors link dependencies outside the project root; webpack supports that deployment topology while Turbopack rejects it.
TypeScript ownership	Immutable scaffold	Runtime-specific wildcard path aliases bypassed normal package type resolution and caused false build failures.
Browser action contract	Method-specific union plus strict tools	Required fields are visible in generated JSON Schema instead of hidden in runtime refinements.
Automation failure behavior	Preserve framework architecture	A malformed verification call is not evidence that React state or event handling is defective.

Edge Cases Handled

Scenario	Handling
click/hover action receives a value	rejected by the schema
fill/type action omits its value	rejected before driver execution
drag-and-drop omits its destination	rejected before driver execution
linked dependency tree reaches Next build	snapshot smoke runs a full production build through the same native-mirror package transaction
browser driver reports a validation error	agent corrects the call once and keeps the application architecture intact

How to Review

1. Review packages/agent-core/src/tools/browser/actions.ts for the model-facing action contract.
2. Review infra/containers/sandbox/app-templates/next/ and the scaffold writer for the single template boundary.
3. Review .github/workflows/build-snapshot.yml for the image acceptance test.
4. Review the system-prompt change for verification failure handling.

Verification

• pnpm lint
• pnpm typecheck
• pnpm turbo build --force
• pnpm deadcode
• pnpm architecture:check
• pnpm turbo skills:build
• fresh immutable Next template install and production build
• sandbox image workflow and production browser acceptance (after merge/promotion)

No Linear issue or plan document is associated with this production defect investigation.