Code against the polyfill's published contract, and nothing else

The data layer is now reached through one pulled, version-pinned engagement
(`.project/concepts/data-layer/contract_polyfill-surface.md`, @1ecf511e9d).
That copy is the only reference: the provider's sources are never opened, and
what the contract does not answer is a gap raised with it, never worked around
here.

Surface
- `@ng-eventually/sdk` -> `@ng-eventually/polyfill`, one entry point.
- `configure` loses `getSession`, `normalizeId`, `currentUser`; the session
  belongs to the package and its own `init` captures it.
- Placement is named by scope alone -- a session is one user, so the app no
  longer passes an identity it had no way to obtain. This removes a constant
  that made every user collide on one owner's document.
- `init(...)` then `await ensureIdentity()`, in that order, as one sequence:
  React runs child effects first, so the two calls sat in the wrong order and
  the contract now makes that throw.
- `sessionId` relayed as `string | number`, `materialize` -> `read`.

A rejection means "unknown", never "absent"
Four places treated a caught error as an empty result. The worst wrote a
duplicate participation: an unknown count read as zero defeated the idempotence
guard of `joinEvent`. Also fixed: a per-document count, a silently dropped
notification shown optimistically anyway, and a failed listing that left the
owned-event set empty and disabled the materializer for the whole session.

Shared identity is not a Festipod notion
A browser context is one user. The per-scenario identity plant is deleted at
its source and its five sites; what stays is the deployment's wallet file,
which the contract requires an application to serve.

Documentation
The doctrine no longer describes how the data layer works underneath: five
leaves whose subject was internals are gone, a dozen more are re-founded on the
contract's own words, and two frozen arbitrations about a deleted screen were
removed rather than left to mislead a future session.

Test harness
It can sign in at last: cucumber runs under node, which does not load `.env`,
so the harness never received the wallet material and every scenario silently
fell back to an empty local mode. A failed sign-in is now loud on both sides.
The suite also releases what it opens and exits on its own -- runs were still
resident hours after reporting, holding a browser and two servers.

Known red: `@data` cannot be measured. The served wallet accumulates and
nothing resets it; moving the browser profile aside does not, since the data
lives in the wallet file, not the profile.

build.ts

@@ -133,12 +133,9 @@ const result = await Bun.build({
   sourcemap: "linked",
   define: {
     "process.env.NODE_ENV": JSON.stringify("production"),
-    // Access gate (ON by default) + shared wallet password, baked into the
-    // browser bundle as globals (see src/app/AuthGate.tsx, sharedWallet.ts). The
+    // Shared wallet password, baked into the browser bundle as a global (see
+    // sharedWallet.ts) and handed to the SDK by the ONE `configure` call. The
     // wallet FILE is copied into the outdir below (served at /shared-wallet.ngw).
-    "globalThis.__FESTIPOD_ACCESS_GATE_DISABLED__": JSON.stringify(
-      process.env.ACCESS_GATE_DISABLED === "1",
-    ),
     "globalThis.__FESTIPOD_SHARED_WALLET_PASSWORD__": JSON.stringify(
       process.env.FESTIPOD_SHARED_WALLET_PASSWORD ?? "",
     ),
@@ -151,8 +148,9 @@ const result = await Bun.build({
   ...cliConfig,
 });
 
-// Staging: copy the shared wallet FILE into the bundle so the access gate can
-// offer it for download (served at /shared-wallet.ngw). See sharedWallet.ts.
+// Staging: copy the shared wallet FILE into the bundle so it can be offered for
+// download (served at /shared-wallet.ngw — the `fileUrl` the app hands the SDK
+// through `configure`). See sharedWallet.ts.
 if (process.env.FESTIPOD_SHARED_WALLET_FILE) {
   const { copyFileSync } = await import("fs");
   copyFileSync(process.env.FESTIPOD_SHARED_WALLET_FILE, path.join(outdir, "shared-wallet.ngw"));