[Feat] Render widgets in Fast session transcripts

[roomote-roomote]

​Opened on behalf of @daniel-lxs. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Adds a parent-only show_widget native tool to Fast sessions.
• Reuses the task-session widget sanitizer and transcript preview introduced in [Feat] Add show_widget tool for presentational HTML in task transcripts #503, including the existing sandboxed iframe and CSP.
• Persists trusted, sanitized widget results in Fast transcript rows and checks the exact pretty-serialized payload before accepting results at the web transcript boundary.
• Keeps dompurify and jsdom external to the API bundle and ships matching versions in the standalone API runtime dependency tree.
• Posts only textFallback to Slack and Discord; raw HTML remains confined to the web transcript.

Why this change was made

Fast agents could not use the first-party presentational widget capability already available to task sessions. Sharing the sanitizer and renderer avoids security drift and a second Fast-specific UI path, while explicit API externals keep the sanitizer dependencies resolvable in both development and shipped runtime builds.

Impact

Fast sessions can now display status cards, tables, plans, and other safe presentational HTML inline in the web transcript. Third-party or unmarked native tool output cannot opt into widget rendering, oversized widgets fail cleanly instead of persisting truncated invalid JSON, and the API bundle loads the sanitizer from its declared runtime dependency tree.

Validation

• 80 focused cloud-agent tests covering native exposure, sanitization, persistence, exact serialization limits, and chat fallback behavior.
• 48 focused worker widget and tool-registration tests.
• 20 focused web tests covering trusted parsing and Fast transcript rendering through the shared sandboxed preview.
• @roomote/api build and typecheck passed; the built bundle retains external imports for dompurify and jsdom, and both resolve from the API and standalone runtime dependency directories.
• The DOMPurify version-parity expressions return 3.4.13 from both dependency trees by resolving the exported runtime entry, without requiring the blocked dompurify/package.json subpath.
• Full pnpm lint and pre-push checks passed.
• The Docker build-api target could not run because this sandbox has no Docker daemon; pnpm deployment:validate completed compose-shape validation before hitting the same daemon limitation.
• Browser proof was attempted but unavailable because local dev login remained blocked on inference-provider setup (Ollama was unreachable), so no screenshot is attached.

[roomote-community]

No new commits or code issues since the last review. See task

• The API's startup bundle cannot resolve the sanitizer dependencies from the new shared module (packages/cloud-agents/src/server/show-widget.ts:48).
• The Fast widget size guard accepts a compact JSON payload that is too large after the persisted pretty serialization (packages/cloud-agents/src/server/fast-agent/fast-agent-service.ts:1429).
• The API Docker build fails while checking the external sanitizer dependency versions because dompurify/package.json is not an exported package subpath (.docker/app/Dockerfile:185).

_{Reviewed 5ef77ee}

[roomote-roomote]

Resolved all review findings. 7eb643cf makes the widget guard measure persisted pretty JSON. 6be05f4a and 31d3ecef ship sanitizer dependencies through API externals and the standalone runtime tree. c722012d reads the DOMPurify version through its exported runtime entry instead of the blocked package subpath. Focused tests, API build/typecheck, runtime and parity expressions, lint, fast typechecks, and knip passed. Docker target execution was unavailable because this sandbox has no Docker daemon.

[daniel-lxs]

Tested locally. Fast widget rendering, host-theme bridging, fixed-canvas sizing guidance, and shared worker/Fast contracts are verified.