docs: OSINT foundations, Tui design, and native component UI direction

[amasiye]

Summary

• Add Stage 40a network/data foundations and separate OSINT prototype checkpoint 40b after Stage 40a, concurrent with Stage 41.
• Start Doria\Tui design against the Stage 36a substrate, with portable executable acceptance after Stage 46.
• Expand the UI product into a native component framework with stylesheet files, Doria/PHP authoring, and host-neutral adapter boundaries.
• Add supporting package design with explicit ownership, lifecycle, input, accessibility, evidence/review/replay, and comparison-test goals.
• Preserve separate package repositories and distinguish the Stage 41 PHP-to-Doria bridge from a native app executing PHP callbacks.

Validation

• git diff --check passed.
• Existing authority/dependency claims were swept and synchronized.
• The GitHub tree is byte-identical to the reviewed local commit tree.
• PHP is not installed in the execution environment, so PHP documentation guard execution is pending repository CI.
• No compiler/runtime implementation changes; no claim that the new package APIs are implemented.

Design review

The requested product direction and OSINT sequencing are recorded. Exact component APIs, CSS subset/cascade, renderer backend, and PHP callback/embedded-host ABI remain focused design decisions before implementation. March–August 2027 is preserved only as the provisional planning window discussed, at 25 focused hours/week, subject to re-estimation.

Invalidated elsewhere

• Stage 44 no longer owns the first usable network/HTTP/TLS client. Stage 40a owns it; Stage 44 matures/hardens it.
• Decision 0110 and its documentation guard, stdlib reference, native Baton dependency note, and pipeline summary use that split.
• The UI product description now includes native components/styles and a reviewed PHP host path.
• TUI widgets remain userland with Doria\Tui as the named consumer.
• No accepted source API, syntax, IDE fact, installed binary, or website example changes in this planning beat; future APIs require ordinary synchronization.