feat: complete warn-first web icon policy flow

[mikeylong]

Summary

Complete the warn-first web icon policy flow across extraction, validation, diff, normalize, and compile.

What changed

• Seed web-surface icons policy in generate-contract from observed descriptor icon imports.
• Add icon-source drift comparison in diff (icons.allowedSources) with policy-based severity.
• Normalize descriptor/contract icon arrays deterministically.
• Include per-surface icons payload in compile output.
• Add/extend tests for icon policy seeding, validator behavior (warn/strict), compare/normalize/compile propagation.
• Update docs (README, API, contract-baseline) and mark this increment warn-first complete.

Verification

• pnpm install --frozen-lockfile
• pnpm run build
• pnpm test

Notes

• This PR intentionally closes warn-first implementation.
• Strict rollout in canonical contracts is handled downstream in surfaces-webapps.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
interfacectl	Error		Feb 18, 2026 4:50am