feat(f11): SLICE-5 — gateway, non-authorable disabling, docs (#43)

Closes the F11 feature: makes the toolbar surface reachable end to end and
guards the edit controls. Per spec §6.4/§6.5/§7.2 SLICE-5.

- package.json: cowriting.showTrackChangesPreview added to editor/title
  (when: editorLangId == markdown) — the minimal right-click → Open Review
  Preview gateway (#41/#42 expand it later).
- trackChangesPreview: the gateway command accepts the tab's resource Uri
  (palette/keybinding still fall back to the active editor); refresh() sends an
  `authorable` flag on both render messages; `editControlsEnabled` test seam.
- webview: disable Pin + Ask-Claude on a non-authorable doc (Annotations stays
  active — reading is always allowed); RenderMessage.authorable.
- host E2E: the editor/title gateway opens the preview + is markdown-guarded;
  edit controls disabled on a non-authorable (read-only-scheme) markdown doc.
- docs: docs/MANUAL-SMOKE-F11.md (live smoke, 10 steps) + README F11 section +
  intro line.

205 unit + 53 host E2E green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

media/preview.ts

@@ -18,6 +18,8 @@ interface RenderMessage {
   html: string;
   epoch?: string;
   summary?: { added: number; removed: number; proposals: number };
+  /** F11: false on a non-authorable doc → Pin + Ask-Claude controls disabled. */
+  authorable?: boolean;
 }
 
 const vscodeApi = acquireVsCodeApi();
@@ -124,6 +126,10 @@ window.addEventListener("message", (event: MessageEvent<RenderMessage>) => {
   if (msg?.type !== "render") return;
   body.innerHTML = msg.html;
   updateAskLabel(); // new content clears any selection → reset the adaptive label
+  // F11 (PUC-1/7): disable edit controls on a non-authorable doc (reading stays on).
+  const authorable = msg.authorable !== false;
+  if (pinEl) pinEl.disabled = !authorable;
+  if (askEl) askEl.disabled = !authorable;
   const on = msg.mode === "on";
   if (annotationsEl) annotationsEl.checked = on;
   // Off-state is a clean preview: hide the review chrome.