Co-authored-by: Ignacio Esteban Losiggio <iglosiggio@gmail.com>

SelectF128: update frozen CDF index behavior

Co-authored-by: Daniel McGregor <daniel.mcgregor@makerx.com.au>
Co-authored-by: John Jannotti <jannotti@gmail.com>

Pass branch and full_coverage through env: before run: scripts
(script-injection class for workflow_dispatch/workflow_call inputs).

Co-authored-by: Cursor <cursoragent@cursor.com>

- `/manage/period/$periodId` now has two faces. Edit is opt-in via `?mode=edit`; View is the absence of that param, and `validateSearch` normalizes any other value to View. A View/Edit toggle sits in the header, hidden when there is no wallet or the period is frozen.

- Every write affordance now gates on one flag: `showEditControls`, defined as connected SDK + `mode === 'edit'` + `editable`. `editable` now means the period is not frozen, based on readiness and votes. This replaces the previous status-based definition.

- Dropped the `status === 'upcoming'` condition. The contract's `editPeriod` only asserts operator, `!ready`, and `end > start`, so a draft whose voting window is active or has passed is still editable on chain.

- A ready period with no votes cast is still editable because it can be reverted to draft. It keeps edit controls live in Edit mode and shows a warning that changes will fail until it is reverted. The contract, not the UI, rejects those writes.

- Added `src/utils/periodEditing.ts` with shared `periodHasVotes` and `periodFrozen`, used by the list and detail page. A ready period with votes cast is frozen, so it gets no Edit affordance and no View/Edit toggle.

- Manage periods list: the title cell links to View, and the actions column holds a single button per row: Edit, or View for a frozen period.

- Misc: the Upcoming status chip no longer uses `bg-accent`; it now uses a custom soft pink so it is visually distinct from Ended. This intentionally uses a Tailwind color outside the design tokens because it only appears in the operator-only Manage UI.

Fix labels sitting too close to their inputs. In Tailwind v4, `space-y-*` sets margin-bottom on the label, and a plain `<label>` is inline — inline elements ignore top and bottom margins, so the spacing did nothing. `ui/label.tsx` is now `block`, which takes the gap from 1.8px to the 8px it was meant to be, in every form.

- Show the period title in the /manage list. New Title column, and the whole row is now one `PeriodTableRow` component so the period body is read once per row instead of twice — the title and the ballot label both come from it, and the list query doesn't include it.

- The voting window column now shows dates only, with the full UTC times on hover. This needed a new `formatDateRangeUTC`: the existing `formatDateRange` uses the viewer's timezone, and the manage panel works in UTC, so it could show a different day than the tooltip below it.

- Sample data: election ballots read Support / Veto / Abstain, matching what the manage UI writes.

pnpm audit --audit-level=high was failing on:

- undici >=7.0.0 <7.29.0 (GHSA-4cwx-7wf7-3272) -> new override ^7.29.0
- fast-uri >=3.0.0 <3.1.5 (GHSA-7p8r-x3mc-p8w7) -> ^3.1.4 bumped to ^3.1.5
- brace-expansion >=4.0.0 <5.0.9 (GHSA-rgw5-rvv9-x895) -> @5 ^5.0.8 bumped to ^5.0.9

Resolving the workspace with overrides: {} showed upstream now satisfies several floors on its own, so the dead and non-security ones are dropped: @isaacs/brace-expansion (no longer in the tree at all), flatted, rollup, minimatch@9, minimatch@10 and picomatch@4. sharp, undici, ws@7 and the @joshwooding plugin are still load-bearing and stay.

tar and postcss had drifted below their current advisories, so their floors move to ^7.5.21 (GHSA-r292-9mhp-454m) and ^8.5.23 (GHSA-fxqj-rqcc-2cmp), clearing two moderates as well.

Override comments now carry only the advisory that sets the current floor. The earlier IDs are subsumed by the higher floor and had already gone stale on tar and postcss.

undici 7.29.0, tar 7.5.22 and postcss 8.5.24 are all past the workspace minimumReleaseAge, so only the existing brace-expansion and fast-uri excludes remain. Frontend and contracts builds verified.