[LiranCohen]

The browser SDK now leaves service-worker activation to the host. This starter explicitly activates updates immediately, preserving its existing behavior with published @enbox/browser@0.3.85. Applications such as Notesd can instead request approval and drain edits before activation.

Use the same application layout as Notesd: page-owned application options under app/, domain code under features/, and reusable UI under components/. Remove the redundant shared/ directory and the hot-disposal hook that could retire a connected runtime without an application drain policy.

Prepare @enbox/react@0.0.10 and @enbox/create-dapp@0.0.5. React's exact browser peer/development pin, the React 18 fixture, and the generated template now use browser 0.3.85; the template pins React 0.0.10. API remains 0.6.91. The refreshed locks contain published dependencies and no temporary overrides. React runtime APIs are unchanged.

Validation:

• bun run check: type contracts, 102 React 19 tests, 8 built-package tests, 18 generator tests, and dependency audit passed.
• Packed React 18 consumer: type contracts, 99 tests, and dependency audit passed.
• Packed generated npm and Bun apps: fresh audited installs, production builds, reproducible lockfile installs, native encrypted task-board integration, all 12 Chromium tests, and worker-separation smoke passed.
• Packed manifests verified as React 0.0.10, generator 0.0.5, and template React 0.0.10/browser 0.3.85.

Release order after merge and approval: publish React to next, wait for npm visibility, then publish the generator to latest. This PR does not publish either package. The browser prerequisite is already released from enbox#1810.