feat: add display kiosk host

docs/architecture/repository-boundaries.md

@@ -36,6 +36,11 @@ These rules map platform ownership to filesystem and package boundaries. The exe
   Node's global declarations — into browser code. Core still owns the containing
   application shell and all platform policy, and module UI reaches the host only through
   `@ekklesia/module-ui-sdk`.
+- Manifest v6 permits independently optional primary (`entrypoints.ui`) and full-viewport display
+  (`entrypoints.display`) artifacts. Modules own both feature experiences; surfaces own their
+  containers, routes, navigation/chrome, credentials, error states, and publication wiring. The
+  fixed authoring sources are `src/ui/index.tsx` and `src/display/index.tsx`; both use the same
+  role-neutral UI SDK ABI and neither may import a surface or host loader.
 - Module UI **asset publication** runs Core → `apps/api`, never the other way
   ([ADR 0025](decisions/0025-trusted-module-ui-asset-publication.md)). Core owns the policy
   (`createModuleUiPublicationRegistry`, built only from already-validated `DiscoveredModule`
@@ -69,6 +74,10 @@ These rules map platform ownership to filesystem and package boundaries. The exe
   mount arrives at run time as a URL from the module UI inventory, is fetched by the generic loader,
   and is never bundled into the shell. Its own build (esbuild, owned by that package) is a separate
   concern from `@ekklesia/module-ui-build`, which compiles a *module's* declared artifact.
+- The display browser application is a separate surface entrypoint under `surfaces/shell`; it also
+  statically imports no module and mounts only the exact display descriptor/artifact supplied by the
+  API. It contains no Dashboard chrome and does not move display rendering into the surface—the
+  module still owns that renderer.
 - Separate surfaces do not import each other's internals.
 - Builder code composes contracts and surface renderer identifiers; it does not import module or
   surface internals.