fix(examples): prepare research desk for canonical A2UI 1.0 - #8157

The research desk reads canonical 1.0 capabilities and emits 1.0 operations in Express compilation, snapshot updates, Direct JSON streamed headers, and the component gallery. Source labels and fixtures use the same spelling, and the experimental v1.0 capability key is rejected.

CopilotKit 1.84.0 is published, including merged #8155/#8161. Python dependencies use real published ag-ui-adk==0.12.0, a2ui-agent-sdk==0.10.0, and a2ui-core==0.5.0, with the regenerated PyPI-only uv.lock; no local adapter source installation is required.

This PR stays draft for two reasons:

• The existing test_explicit_action_maps_keep_user_message_context_and_client_functions test fails with upstream ExpressForbiddenDatabindingError on valid bound event context. The assertion remains intact; no skips, xfails, schema weakening, or parser workaround are added.
• This PR is stacked on feat(examples): A2UI Playground, a generative UI demo on Google ADK and Gemini #7965 (tylerslaton/a2ui-playground), whose workspace package source still predates canonical fix(genui)!: require canonical A2UI 1.0 messages #8155. Production dependencies intentionally remain workspace:*. The parent needs a refresh to source containing the merged foundation/release before the ordinary stacked checkout can be considered ready. Published npm availability does not update those workspace links. This follow-on does not merge unrelated main changes or mutate the author's parent branch.

Fresh release validation used a clean external copy of the example, installing actual npm @copilotkit/react-core@1.84.0 and @copilotkit/runtime@1.84.0 in place of workspace declarations only in that temporary validation manifest. It carried the repository's existing AG-UI 1.0.2→1.0.3 alignment rule. No local package links or old #8155 artifact overlay were used; lockfile integrity values match the official npm tarballs.

Validation:

• Clean published 1.84.0 frontend install, typecheck, and production Vite build passed.
• The actual Gemini/Python endpoint completed a JSON response with canonical operations, and the published frontend displayed its generated title, text, and button.
• Two deterministic published-frontend integration checks passed: captured-real JSON SSE replay and an Express fixture streamed through the published Python SDK and the app transport. Both rendered UI, sent only canonical 1.0 capabilities/operations, and executed the saveNote browser function without page errors. These checks made no additional provider calls.
• The unchanged published Python lock was previously verified by clean uv sync --locked, uv pip check, real imports, canonical native-stream completion, and HTTP agent /health 200. Its deterministic suite remains 121 passed, 1 upstream SDK failure, with two ADK experimental warnings.
• The release follow-up changes only README validation/release status. Scoped formatting, relative links, and diff hygiene passed.

Full live-provider Express conversations, bound agent-event context, authenticated threads/Intelligence persistence, and Connections are not claimed as verified. The existing app snapshot orchestration preserves prior-surface updates and deferred destructive programs; parsing and compilation remain upstream-owned.