feat(06-05): capability guards — haptics + close protection + optional webapp members + RS10/BA9 gate bumps (GREEN)

- fireHaptic: the three D-08 cues (selectionChanged / impactOccurred medium / notificationOccurred success) via ?. chains; silent no-op without the API; header carries the no-haptic-on-reroute law
- engage/releaseCloseProtection: PX-03 layers gated BEFORE each call — isVersionAtLeast("7.7") body-swipe, ("6.2") native-close net; no-throw on capability-less clients (T-06-06)
- webapp.ts: HapticFeedback / vertical-swipes / closing-confirmation / isActive join as OPTIONAL members only — existing fakes untouched
- RS10 floor 16→24; BA9 input list += web/src/guidance (69507 / 204800 gz, printed)

web/test/build-artifact.test.mjs

@@ -37,9 +37,10 @@
  *       its own.
  *   BA9 the route payload fits the D-11 bundle budget: the summed gzipped
  *       size of the fixture dataset (routing/src/data/route-fixtures.json),
- *       every routing/src *.ts, and every web/src/route *.ts is ≤ 204800
- *       bytes (200 KiB) — and the measurement is PRINTED on every run (the
- *       budget is visible, never discovered). T-05-12.
+ *       every routing/src *.ts, every web/src/route *.ts, and every
+ *       web/src/guidance *.ts is ≤ 204800 bytes (200 KiB) — and the
+ *       measurement is PRINTED on every run (the budget is visible, never
+ *       discovered). T-05-12.
  *   BA10 the shipped JS carries EVERY pairId from the committed
  *       route-fixtures.json (the BA7 analog, T-05-12/D-11): a stale bundle
  *       that lost the fixtures could never serve a route.
@@ -187,9 +188,12 @@ test("BA8 the shipped bundle carries NO deep-link crypto (D-11, T-04-40)", () =>
 
 /* ————— the route family's production-build gates (05-05, D-11, T-05-12) ————— */
 
-/* BA9's inputs: every committed file the route experience ADDS to the web
- * bundle — the fixture dataset, the routing workspace sources, and the web
- * route modules. All are committed files, production-shaped by construction.
+/* BA9's inputs: every committed file the route + guidance experience ADDS to
+ * the web bundle — the fixture dataset, the routing workspace sources, the
+ * web route modules, and (Phase 6) the web guidance modules (glyphs, banner,
+ * haptics, close-protection, guidance, eta, watch — the camera lands in plan
+ * 06 and rides the same list then). All are committed files,
+ * production-shaped by construction.
  * The minified route code's gz size is approximated by its SOURCE gz size —
  * the approximation is conservative in the gate's favor at these sizes
  * (minified+gzipped code is smaller than source gzipped), and the 200 KiB
@@ -200,6 +204,7 @@ test("BA8 the shipped bundle carries NO deep-link crypto (D-11, T-04-40)", () =>
 const ROUTE_INPUT_DIRS = [
   join(WEB, "..", "routing", "src"),
   join(WEB, "src", "route"),
+  join(WEB, "src", "guidance"),
 ];
 const ROUTE_FIXTURES_FILE = join(WEB, "..", "routing", "src", "data", "route-fixtures.json");