Default Move shortcuts off and configure Canary branch

[Yuqing (mydmdm)]

Summary

• default the Move-to source Space shortcut option to off on every open while preserving explicit opt-in behavior
• persist an owner-configured Canary branch with alpha as the unconfigured default
• bind checks, status, confirmation, and fixed-script redeployment to one strictly validated origin branch
• reject stale or concurrent Canary operations without allowing configurable commands, remotes, paths, or argument shapes

Validation

• pnpm typecheck
• pnpm format
• pnpm lint:fix
• pnpm --filter @huabu/server test (2435 passed, 28 skipped, 2 todo)
• pnpm --filter @huabu/web test (3032 passed)
• focused shared deployment contract tests (3 passed)
• pnpm check:i18n
• pnpm --filter @huabu/web build
• bash -n scripts/start-huabu.sh
• node --check scripts/canary-redeploy-runner.mjs

Known limitation

The documented post-build grep -l 'ZodObject\|safeParse' check still finds the existing main Web bundle because current production runtime imports from the shared barrel already retain zod-backed modules. This change adds only type-only shared imports in Web code and does not introduce a new runtime schema import.

Closes #270