fix: reject invalid TUI transcript frames atomically

[jsmestad]

Summary

• prepare transcript mutations against one detached candidate before any frame publication
• reject the complete frame with correlated retryable transcript-desync status when any transcript command cannot apply
• publish ordered transcript commands once only after the frame passes validation
• preserve committed window, chrome, transcript, scroll, and pin state on rejection
• route shared conformance and Elixir recovery coverage through production transaction boundaries

Validation

• go test ./...
• mix test test/minga_editor/frontend/protocol_test.exs test/minga_editor/renderer/server_test.exs (175 tests)
• mix protocol.gen --check
• mix conformance (162 tests)
• make lint
• focused protocol bug hunt: no findings
• final acceptance review: PASS, no warnings

Closes #3302