fix(runtime): 按参考主题硬切换为 loader/main/auto_fun 单一 DOM 生命周期

- 删除 AksrtFrontend registry/rehydrate 双路架构及 build/public.js 拼包入口，
  前台唯一初始路径为 PHP 本地栈（jQuery 1.9.1 → Bootstrap 3.4.1）
  → loader_js（_win/aksrtData 唯一注入）→ tbquire(['main']) → runtime/main.min.js
- window.auto_fun = debounce(z_auto_fun, 100) 为唯一重扫入口；所有模块改为
  执行一次 + off/on('auto_fun.aksrt-*') 命名空间重扫，data/class 标记幂等
- 局部更新协议统一：HTML 注入 → post_ajax.ed → auto_fun()；
  远程 modal → loaded.bs.modal → auto_fun()；JSON 成功 → zib_ajax.success
- 灯箱恢复 Miniimgbox/imgbox 唯一 owner（imgbox-container、a[data-imgbox]、
  imgbox_data），删除 AksrtLightbox/data-aksrt-lightbox 第二实现及 CSS/overlay，
  _win.imgbox* 重新接上 post-display 设置
- 死代码清理：runtime 下 11 组被自有实现替代的旧模块副本、无消费 vendored 库、
  顶层 grade.min.js、revenue.js、无调用方的 aksrt_get_win_runtime_config()，
  以及 loader 中 16 条死 mapping
- PHP 入队改为本地栈 + loader_js，routed/widget/submit 依赖统一换绑；
  用户卡片发布按钮恢复 nav_user_newposts_btn 设置门控
- 测试对齐：新增 frontend-lifecycle-contract，重写 navigation/lazyload/toast/
  auth-source/comment/page-display/post-visual 等断言为目标架构契约

验证：node --test widget-system+navigation 223 通过 0 失败；
构建脚本重建 main/imgbox min 与 CSS bundles；改动 PHP php -l、JS node --check
全部通过；git diff --check 干净；credits 重入 harness 通过。

tests/widget-system/frontend-lifecycle-contract.test.cjs

@@ -0,0 +1,90 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const test = require('node:test');
+
+const root = path.resolve(__dirname, '..', '..');
+const read = (file) => fs.readFileSync(path.join(root, file), 'utf8');
+
+function sourceFiles(directory) {
+  const files = [];
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    if (['.git', 'build', 'node_modules', 'runtime', 'third-party', 'vendor'].includes(entry.name)) continue;
+    if (/\.min\.js$/.test(entry.name)) continue;
+    const full = path.join(directory, entry.name);
+    if (entry.isDirectory()) files.push(...sourceFiles(full));
+    else if (/\.(?:js|cjs|mjs|php)$/.test(entry.name)) files.push(full);
+  }
+  return files;
+}
+
+const routed = [
+  'assets/js/auth.js',
+  'assets/js/author.js',
+  'assets/js/credits.js',
+  'assets/js/order-center.js',
+  'assets/js/reward.js',
+  'assets/js/routes/user-center.js',
+  'assets/js/signin.js',
+  'assets/js/section-navs.js',
+];
+
+test('loader maps and boots the single main module', () => {
+  const loader = read('assets/js/runtime/loader.js');
+  assert.match(loader, /['"]main['"]\s*:\s*['"]main\.min['"]/);
+  assert.match(loader, /tbquire\(\[['"]main['"]\]\)/);
+  assert.equal((loader.match(/tbquire\(\[['"]main['"]\]\)/g) || []).length, 1);
+});
+
+test('main owns the one global auto_fun boot', () => {
+  const main = read('assets/js/runtime/main.js');
+  assert.match(main, /window\.auto_fun\s*=\s*debounce\(/);
+  assert.match(main, /jQuery\(document\)\.trigger\(['"]auto_fun['"]\)/);
+});
+
+test('routed modules use one namespaced auto_fun owner and no registry', () => {
+  for (const file of routed) {
+    const source = read(file);
+    assert.match(source, /\.off\(['"]auto_fun\.[^'"]+['"]\)\.on\(['"]auto_fun\.[^'"]+['"]/, file);
+    assert.doesNotMatch(source, /AksrtFrontend|aksrt\.autoFun|aksrt:(?:ready|rehydrated)/, file);
+  }
+});
+
+test('HTML fragment injection announces post_ajax before auto_fun', () => {
+  for (const file of ['assets/js/core/pagination.js', 'assets/js/author.js', 'assets/js/credits.js', 'assets/js/routes/user-center.js']) {
+    const source = read(file);
+    assert.match(source, /post_ajax\.ed[\s\S]*?window\.auto_fun\(\)/, file);
+  }
+});
+
+test('modal fragment lifecycle reruns auto_fun after loaded.bs.modal', () => {
+  const source = read('assets/js/runtime/main.js');
+  assert.match(source, /loaded\.bs\.modal[\s\S]*?auto_fun/);
+});
+
+test('JSON success lifecycle remains zib_ajax.success', () => {
+  const source = read('assets/js/runtime/main.js');
+  assert.match(source, /zib_ajax\.success/);
+});
+
+test('Miniimgbox owns data-imgbox and lazySizes has one integration owner', () => {
+  const imgbox = read('assets/js/runtime/imgbox.js');
+  const lazy = read('assets/js/runtime/main.js');
+  assert.match(imgbox, /Miniimgbox/);
+  assert.match(imgbox, /data-imgbox/);
+  assert.match(lazy, /lazybeforeunveil/);
+  assert.match(lazy, /MutationObserver/);
+});
+
+test('non-generated first-party sources contain no deprecated lifecycle API', () => {
+  const files = sourceFiles(root).filter((file) => {
+    const relative = path.relative(root, file).replaceAll('\\', '/');
+    return relative !== 'tests/widget-system/frontend-lifecycle-contract.test.cjs';
+  });
+  for (const file of files) {
+    const source = fs.readFileSync(file, 'utf8');
+    assert.doesNotMatch(source, /AksrtFrontend|aksrt\.autoFun|aksrt:(?:ready|rehydrated)/, path.relative(root, file));
+  }
+});