feat(hub): client-context parity — iframe skip guard, entry-scoped messages, level shortcuts

[antfubot]

Closes the gaps between the hub's headless client runtime and the contract documented in vitejs/devtools docs/kit/client-context.md, which @vitejs/devtools-kit/client fulfils by re-exporting our DockClientScriptContext.

What changed

• Iframe skip guard — the doc promises the client boots in top-level windows only, so a nested frame never publishes a second context or re-runs every dock client script. createDevframeClientHost() now skips inside iframes for 'embedded' hosts (standalone hub pages stay bootable when intentionally iframed), overridable via the new skipInIframe option. The result is a discriminated union: DevframeClientHost | DevframeClientHostSkipped.
• Entry-scoped messages client — dock client scripts were all handed one shared, unscoped messages client despite the doc (and our own comment) promising one "scoped to the entry". Each script now gets its own client whose messages default their category to the dock entry id, so the feed can attribute and group them; explicit input fields still win.
• Per-level message shortcuts — the doc's example calls ctx.messages.info(...); DevframeMessagesClient and DevframeMessagesHost now share info/warn/error/success/debug shortcuts delegating to add(), keeping the server/client API symmetric.
• Double-boot warning + clean teardown — booting a second host on a page now warns (matching the doc's troubleshooting guidance about mounting the client twice), and dispose() unpublishes the global context when it still owns it.

Everything else in the doc — the context table (rpc, clientType, docks, panel, commands, when), the global accessor, current with DOM elements/events, and parent-window RPC discovery for iframe panels — was already at parity.

API snapshots (tsnapi) regenerated for the @devframes/hub surfaces.

---

Created with the help of an agent.

[netlify]

✅ Deploy Preview for devfra ready!

Name	Link
🔨 Latest commit	4ffa6dd
🔍 Latest deploy log	https://app.netlify.com/projects/devfra/deploys/6a4630b8c1a1d90008707bac
😎 Deploy Preview	https://deploy-preview-57--devfra.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[antfubot]

Added the first real consumer of the client-script contract: the a11y agent now uses the client setup (4ffa6dd).

• runA11yAgent(context?) accepts the hub's DockClientScriptContext (duck-typed via a minimal structural slice, keeping the agent free of any @devframes/hub dependency — same pattern as the terminals/code-server plugins) and mirrors every scan into the hub messages feed: a deduplicated summary entry driven loading → idle, plus one entry per violated rule with impact-mapped level, WCAG tags as labels, and the first offending element's selector; cleared rules are removed on re-scan.
• Fixed a latent boot-order bug: the module's import-time self-boot used to win the __DF_A11Y_AGENT__ guard, so the hub-passed context could never take effect. Self-boot is now deferred one macrotask — the hub's context-ful call lands first; plain <script type="module"> boots are unaffected.
• Scanner now carries axe's WCAG tags through the protocol (Violation.tags, optional).
• BroadcastChannel remains the live scan/highlight loop; the feed is a fire-and-forget mirror that never gates scanning.