chore: sync vendored canvas-kit to 2026-07-04.1 (deep linking)

[jongio]

What

Re-vendors the canonical canvas-kit into all 6 extensions, bumping the vendored kit from 2026-07-02.1 → 2026-07-04.1.

The delta this brings is the new deep-link builder module (canvas-kit/deeplinks.mjs) plus the matching client.mjs re-exports, letting canvases construct validated deep links (e.g. open a new session for a repo/PR/branch with a prompt) that mirror the Copilot host app's own link validators.

Changed files (24)

Per extension (code-tutor, language-tutor, news-aggregator, random-animal, stock-ticker, wiki-discover):

• new canvas-kit/deeplinks.mjs — deep-link builders (URL-encoded params, scheme allowlist, untrusted-text quoting)
• canvas-kit/client.mjs — re-exports the deep-link builders
• canvas-kit/version.mjs — KIT_VERSION = "2026-07-04.1"
• canvas-kit/.kit-version.json — sync marker

This is a pure mechanical re-vendor from the canonical create-canvas-app/kit; no extension source code was hand-edited.

Verification

All run locally and green (matches CI validate.yml):

• node scripts/lint.mjs → clean (75 .mjs syntax-checked, 15 .json parsed)
• node scripts/validate-extensions.mjs → 6 extensions valid
• node scripts/run-tests.mjs → 6 smoke-test files pass (133 checks)
• kit freshness/byte-parity check → all 6 vendored kits fresh at 2026-07-04.1

Notes

Branch name (sync-canvas-kit-lucide-1.22) is a leftover from an earlier icons-only sync attempt; this PR was repurposed to carry the current 2026-07-04.1 sync instead of opening a duplicate.