Integrate the expanded core icon catalog

[konojunya]

Background

stack-sh/theme 0.4.0 now provides 30 provider-neutral explicit icons at merged revision 2347315e6e86ab9d2708e05fd3f9b5f3d87e1241. Engine must embed that final provider revision before Web can consume the expanded catalog through a released browser package.

Implementation Approach

• pin the merged Theme 0.4.0 revision and update the audited dependency inventory
• bump stack-engine, stack-engine-wasm, and @stack-sh/engine to 0.5.0
• assert all 30 identifiers and stable subjects in every bundled theme
• change the explicit native/WASM fixture from the pre-existing api icon to the newly added gateway icon
• regenerate byte-stable SVG snapshots with Engine 0.5.0, Theme 0.4.0, and catalog revision sha256:9cb3de8b504acbf22c93cea5fbea66be50f38734dc1dee18b9cab7084082cc1f
• preserve caller-owned provider-pack behavior and the local-only vendor asset boundary

Testing Approach

• Rust workspace tests and canonical formatter/scene conformance suites
• standalone SVG snapshot validation
• browser WASM build, native/WASM fixture parity, type checking, and npm package-content validation
• stable Rust formatting, Clippy, documentation, and coverage gates
• Rust 1.85 workspace tests and Clippy
• local coverage: 95.34% regions, 95.87% functions, and 97.53% lines
• the local WASI parity command could not execute because wasmtime is not installed on this host; PR CI installs the pinned runtime and is the authoritative cross-target gate

Review Perspectives / Points of Concern

• confirm the Theme dependency uses the final squash commit rather than the PR head
• confirm all 30 core identifiers remain warning-free across native and browser adapters
• confirm the 0.5.0 minor release is additive and does not change provider-pack I/O or rights behavior
• verify the CI-provided WASI parity gate before merge and release