feat(f11): SLICE-5 — gateway, non-authorable disabling, docs (#43)

Closes the F11 feature: makes the toolbar surface reachable end to end and
guards the edit controls. Per spec §6.4/§6.5/§7.2 SLICE-5.

- package.json: cowriting.showTrackChangesPreview added to editor/title
  (when: editorLangId == markdown) — the minimal right-click → Open Review
  Preview gateway (#41/#42 expand it later).
- trackChangesPreview: the gateway command accepts the tab's resource Uri
  (palette/keybinding still fall back to the active editor); refresh() sends an
  `authorable` flag on both render messages; `editControlsEnabled` test seam.
- webview: disable Pin + Ask-Claude on a non-authorable doc (Annotations stays
  active — reading is always allowed); RenderMessage.authorable.
- host E2E: the editor/title gateway opens the preview + is markdown-guarded;
  edit controls disabled on a non-authorable (read-only-scheme) markdown doc.
- docs: docs/MANUAL-SMOKE-F11.md (live smoke, 10 steps) + README F11 section +
  intro line.

205 unit + 53 host E2E green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/trackChangesPreview.ts

@@ -15,6 +15,7 @@ import type { AttributionController } from "./attributionController";
 import type { ProposalController } from "./proposalController";
 import { renderReview, renderPlain, diffBlocks, diffToHunks, type BlockOp } from "./trackChangesModel";
 import { buildFingerprint } from "./anchorer";
+import { isAuthorable } from "./workspacePath";
 import type { EditTurnResult } from "./liveTurn";
 
 /** F11: a host edit turn (selection/document text + instruction → rewrite). Injectable for tests. */
@@ -63,9 +64,12 @@ export class TrackChangesPreviewController implements vscode.Disposable {
     private readonly proposals: ProposalController,
   ) {
     this.disposables.push(
-      vscode.commands.registerCommand("cowriting.showTrackChangesPreview", () =>
-        this.show(vscode.window.activeTextEditor?.document),
-      ),
+      // F11 (SLICE-5): the editor/title gateway passes the tab's resource Uri;
+      // the palette / keybinding pass nothing → fall back to the active editor.
+      vscode.commands.registerCommand("cowriting.showTrackChangesPreview", (uri?: vscode.Uri) => {
+        const byUri = uri && vscode.workspace.textDocuments.find((d) => d.uri.toString() === uri.toString());
+        this.show(byUri || vscode.window.activeTextEditor?.document);
+      }),
       // F11: document-scoped Ask-Claude (also reused by #42's gateway). Edits the
       // active markdown doc; the rewrite is diffed into per-hunk F4 proposals.
       vscode.commands.registerCommand("cowriting.editDocument", () => {
@@ -265,8 +269,10 @@ export class TrackChangesPreviewController implements vscode.Disposable {
     const baselineText = baseline?.text ?? current; // no baseline → no change-marks
     const ops = diffBlocks(baselineText, current);
     this.lastModel.set(key, ops);
+    // F11 (PUC-1/7): edit controls are inert on a non-authorable doc (reading stays allowed).
+    const authorable = isAuthorable(document.uri.scheme);
     if (mode === "off") {
-      void panel.webview.postMessage({ type: "render", mode, html: renderPlain(current) });
+      void panel.webview.postMessage({ type: "render", mode, html: renderPlain(current), authorable });
       return;
     }
     const spans = this.attribution.spansFor(document);
@@ -282,6 +288,7 @@ export class TrackChangesPreviewController implements vscode.Disposable {
       html: renderReview(baselineText, current, spans, proposals),
       epoch: this.epochLabel(baseline),
       summary,
+      authorable,
     });
   }
 
@@ -381,6 +388,15 @@ export class TrackChangesPreviewController implements vscode.Disposable {
   setEditTurnForTest(fn: EditTurn): void {
     this.editTurn = fn;
   }
+  /**
+   * F11 (PUC-1/7): whether the previewed doc's edit controls (Pin + Ask-Claude)
+   * are enabled — true only for an authorable doc. The annotations toggle is
+   * always active (reading is always allowed). False if no panel/doc.
+   */
+  editControlsEnabled(uriString: string): boolean {
+    const doc = vscode.workspace.textDocuments.find((d) => d.uri.toString() === uriString);
+    return doc ? isAuthorable(doc.uri.scheme) : false;
+  }
   getLastModel(uriString: string): BlockOp[] | undefined {
     return this.lastModel.get(uriString);
   }