Web build pipeline fixes for #148

[beaucollins]

Fixes found while integrating #148's web build into a downstream consumer. Based on #148.

Fixes

• Web output-flavor declaration matches the compiler's web_output_target (valdi_compiled.bzl): a module emits/consumes web/release only when both the android and ios output targets are release and the build isn't forced to debug; otherwise web/debug. Keying off output_flavor alone mis-declared web/release outputs for debug-target modules (e.g. jasmine) that the compiler only ever writes as web/debug.
• Register transitive module res directories (CollapseWebPaths.cpp): recursively collect every module res directory and break out of the per-directory image scan so transitively-staged res dirs are still registered. Previously only immediate children of src/ were scanned, so transitive-dependency images were bundled but never registered (blank icons at runtime).
• Skip non-web sources in the native collapse pass (valdi_collapse_web_paths.bzl): source files with no web/ segment fall back to a raw path that would escape the -o output directory and fail under a strict sandbox; skip them (they are placed by the main collapse pass) and preserve real module names for compiler-generated web/<flavor>/res.
• Preserve leading .. in the path shim (web_path_browserify_shim.js.tpl): relative-path normalization no longer drops leading parent-directory segments.
• Custom bytes loader instead of the non-existent asset/bytes (web_webpack.config.js.tpl + new web_bytes_loader.js.tpl + wiring in valdi_web_application.bzl / app_templates/BUILD.bazel): webpack has no built-in byte-array module type, so .bin/.protodecl resources are emitted as Uint8Array via a custom loader.
• Synchronize hot-reload lifecycle writes (HotReloadLifecycleReporter.swift): events are emitted from multiple queues; an NSLock serializes writes so concurrent lines are not interleaved.
• Docs: custom-view one-mechanism guidance (native-customviews.md, custom-view skill): a <custom-view> binds its native view via exactly one mechanism — a viewFactory or a platform class name — never both.

[github-actions]

Sensitive Files Detected

🔧 Build rules — Affects build rules for all Valdi consumers.

_{This is an automated notice. A maintainer will review after import.}

[github-actions]

📊 PR Size: size/M

Total changes: 235 lines (12 files)

Top files changed:

• valdi/compiler/toolbox/src/valdi/compiler_toolbox/CollapseWebPaths.cpp: +58 -15
• bzl/valdi/valdi_compiled.bzl: +30 -22
• bzl/valdi/valdi_collapse_web_paths.bzl: +17 -30
• bzl/valdi/app_templates/web_bytes_loader.js.tpl: +13 -0
• docs/docs/native-customviews.md: +5 -6
• compiler/compiler/Compiler/Sources/Reloader/HotReloadLifecycleReporter.swift: +9 -1
• bzl/valdi/valdi_web_application.bzl: +9 -0
• valdi/compiler/toolbox/test/CollapseWebPaths_tests.cpp: +5 -2
• bzl/valdi/app_templates/web_path_browserify_shim.js.tpl: +5 -1
• bzl/valdi/app_templates/web_webpack.config.js.tpl: +3 -1

...and 2 more files

_{Size calculated as additions + deletions. Labels: XS (<10), S (<50), M (<250), L (<1000), XL (1000+)}

[github-actions]

⚠️ Bazel & CI Test Results

Test Suite	Result
Valdi Smoke Tests	✅ success
API Surface Check	✅ success
valdi_web Integration Test	❌ failure
Linux: C++ Tests	❌ failure
Snapshot Tests	✅ success
Linux: Build & Export	✅ success
Linux: Build Compiler	✅ success
Test Coverage Delta	❌ failure
macOS: C++ & Platform Tests	❌ failure
Linux: Hotreload Smoke	✅ success
Linux: Registry Validation	✅ success
Linux: Module Tests	✅ success

Some tests failed. Please check the workflow logs for details.

🚀 Bazel remote cache is now enabled - future builds will be faster!

_{Workflow: Valdi CI}

[beaucollins]

CI failure triage

None of the current failures are introduced by this PR. Comparing against the base branch's own most recent bzl-changes run:

Job	Base branch	This PR	Attribution
valdi_web Integration Test (experiments/helloworld_playground:integration_test)	failing	failing	Pre-existing on base
macOS C++ & Platform Tests (//valdi:valdi_ios_swift_test → AsyncValdiRuntimeTests.testWarmGetRuntimeWithoutInlineDeliveryStaysAsynchronous)	failing	failing	Pre-existing on base
Test Coverage Delta	failing	failing	Pre-existing on base
Linux: C++ Tests	passing	failing	Flaky timeout, not from this diff (see below)

Linux: C++ Tests is the only job that differs from base. It's a test-target timeout — the runtime unit-test binary hung on RuntimeTests/RuntimeFixture.AsyncStrictModeSyncCallAssertsOnMainThread/QuickJS (-- Test timed out --), an async / main-thread-assertion runtime test.

This PR's diff touches nothing linked into that binary:

• CollapseWebPaths.cpp builds the valdi_compiler_toolbox build tool ([for tool]), not the runtime.
• HotReloadLifecycleReporter.swift is the reloader (Swift), not a Linux C++ gtest.
• DiskUtils.* / PathUtils.* are the only runtime C++ files in range and they are byte-identical to the base branch (no diff).

So that binary is identical to base (which passed) — a timing-flaky timeout on this run, not a regression. A re-run of Linux: C++ Tests should go green.

The three pre-existing failures are unrelated to these build-pipeline fixes and also fail on the base branch.