Make the rewind scrubber render a subject-neutral timeline document

[xmap]

Summary

First step of a larger plan (two modes sharing one viewer: a flowing live window, and rewind reaching any run in the record). This step is frontend-only, no transport change, independently shippable.

The scrubber read a Run-shaped payload directly (history.events, history.observations, five hardcoded Run* event-type strings), so every future lens over a different kind of subject would have meant new frontend branching. It now renders a generic timeline document — a time domain plus marker/series lanes, each marker optionally carrying the state it puts its subject into — so adding a lens later is a server-side change with no frontend work. A small bridge adapter in page.html (runHistoryToTimelineDocument) converts today's unchanged run_history wire payload into that document shape; it's expected to move server-side and disappear once the producer emits documents directly (a later step).

Also fixes, found while reading the code for this

• The whole --cs-* color palette was defined on a class (.cora-scrubber) that nothing ever applied to the mount root — the scrubber has been rendering unstyled.
• backToLive() never called the mount's own cleanup, leaking a running requestAnimationFrame loop against detached DOM.
• scaffold() interpolated a run's name/status into innerHTML unescaped — the one injection hole on an otherwise textContent-only page.

Verification

Driven in a real browser (Playwright) against a fake relay server serving fixture run_history data:

• Palette now resolves (--cs-line computed correctly, .cora-scrubber class present).
• XSS payload in a run name renders as escaped text, confirmed no script execution.
• Folded readout correctly walks active → paused → active → ended across a RunStarted/RunHeld/RunResumed/RunCompleted sequence, with per-lane numeric and categorical readings at the cursor.
• backToLive mid-playback correctly invokes cleanup.

No Python files touched; infra/status-relay/ sits outside the repo's Python-scoped pre-commit hooks by design (host-layer artifact, stdlib+websockets only). Full CI still runs since pre-push hooks aren't path-scoped.

🤖 Generated with Claude Code

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.