Graduate the shell out of spikes/ into apps/lumbridge

The product was spikes/gpui-shell: a cargo workspace of its own, named in the
root manifest's exclude list. It inherited neither unsafe_code = "forbid" nor
clippy pedantic, and ./scripts/ci.sh never compiled it. Every test written into
it silently never ran, and apps/lumbridge was an eleven-line stub printing a
version string.

Four separate research passes over the sidebar, settings, devices, and theme
work independently discovered they were about to write substantial new code into
that directory. Graduating first means writing it once.

- apps/lumbridge is the product; spikes/ui-shell-model becomes
  crates/lumbridge-ui-fixture and joins the workspace.
- scripts/ci.sh takes --headless and --ui. The headless pass excludes the two UI
  crates by name, so a contributor changing lumbridge-core does not wait on a
  window toolkit, and a runner that cannot carry GPUI still gates everything
  else. A new crate is headless by default rather than silently joining the slow
  job.
- scripts/native-libs.sh replaces the ad-hoc symlink in the launcher, and says
  which apt package actually fixes the problem instead of working around it
  silently. The stale libxcb/libxkbcommon symlinks in the old spike target
  directory are gone; only libxkbcommon-x11.so was ever needed.
- deny.toml and cargo deny check licenses. spikes/README.md called GPUI's
  licence closure a hard gate and the scorecard scored it pending; graduation
  makes it the product's closure, so it is enforced rather than described. Two
  rejections were reviewed and allowed with the reasoning recorded in the file:
  webpki-roots under CDLA-Permissive-2.0 (Mozilla's CA store, data not code,
  reached through ureq) and libfuzzer-sys under NCSA (reached only under
  all-features via gpui's image decoder; no shipped build links it).

Clippy pedantic across both crates is clean at -D warnings. render was 353
lines; render_sidebar, render_tabs, and render_root come out of it, which the
sidebar rework needed anyway. The remaining over-length functions are single
declarative element trees and carry per-function allows with reasons, not a
blanket suppression.

Decision 0017 records the two calls this forces: published gpui 0.2.2 behind an
accessibility adapter rather than an unpinned Zed revision and an MSRV bump, and
Floem frozen rather than maintained in parity or deleted.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -43,7 +43,11 @@ messages should be real from the beginning.
 
 The scaffold currently contains `lumbridge-core`, `lumbridge-storage`,
 `lumbridge-buzz`, `lumbridge-pty`, `lumbridge-runtime`, `lumbridge-terminal`,
-`lumbridge-harness`, and the entry point. `lumbridge-core` also contains the
+`lumbridge-harness`, `lumbridge-ui-fixture`, and the `lumbridge` application
+itself. The GPUI shell was a spike in an excluded workspace until it graduated
+into `apps/lumbridge`; `scripts/ci.sh` now takes `--headless` and `--ui` so the
+non-UI crates still build in seconds, and `cargo deny check licenses` gates the
+dependency closure that graduation made the product's. See decision 0017. `lumbridge-core` also contains the
 first typed workspace command reducer and the usage ledger. Larger runtime
 crates are added after their architecture spikes pass.
 
@@ -128,7 +132,16 @@ details. The measured spike compares:
 1. GPUI for a Zed-like native model and excellent text-heavy interaction.
 2. Floem for an independent native Rust model with existing editor primitives.
 
-The winner must render six busy panes smoothly, keep input latency low, support
+Floem is frozen: the scorecard records it failing the accessibility hard gate
+with no AccessKit at its pinned revision, and comparability on the footer strip
+was already lost when the usage ledger landed. It is retained as evidence at the
+revision where the comparison was made, not maintained in parity. The product
+ships on published `gpui 0.2.2`, which has no AccessKit either, behind a narrow
+adapter that no-ops today and calls real roles on a Zed revision later — so that
+gate is knowingly unmet and staged rather than quietly dropped. See decision
+0017.
+
+The original comparison bar was that the winner must render six busy panes smoothly, keep input latency low, support
 IME/accessibility, package on macOS and both Linux targets, and avoid a license
 or upstream-stability trap. Current Zed GPUI is the provisional winner because
 its AccessKit semantics compile while the pinned Floem revision has no semantic