[frontend-contrib S16] Quarantine render states + provenance chrome

[rickylabs]

Part of #922

Scope

Quarantine card (fix-CLI + provenance, deep-links the doctor command) for window-mismatch and load-failure; data-ns-plugin/data-ns-contribution wrappers; per-plugin portal root; host-owned CSS layer-order prelude.

Design source: RFC #890 (rfc.md §5) + .llm/runs/plan-frontend-contrib--seed/design/canonical/ (rev 3).

Acceptance

• gate: quarantined contribution never breaks the host shell (fixture)
• gate: CSS layering — app CSS wins over plugin CSS by declaration order (test)