Make the module navigation capability an optional context member

ModuleUiHostContext.navigation is now `navigation?: ModuleUiNavigation |
undefined`, so the public context change is source-compatible: a context built
before navigation existed (without the member) still compiles unchanged, as
0.x patch releases require. The Dashboard supplies navigation; hosts without
addressable pages, including the display host, omit the member; modules
feature-detect it. Existing hosts' tests are restored to their pre-PR shape,
and a module-ui-sdk test proves a pre-navigation context still satisfies
ModuleUiHostContext (and fails if the member is ever made required).
Runtime behaviour, manifest v8/v9 compatibility, and security rules are
unchanged. ADR 0063 and the module development guide say so.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/src/module-context.ts

@@ -274,7 +274,7 @@ export interface CreateModuleUiContextOptions {
    * renderer without a real network. Production composition leaves it unset. */
   readonly importModule?: (url: string) => Promise<unknown>;
   /** The module's navigation capability (ADR 0063), from a host whose pages are addressable — the
-   * Dashboard. Omitted, the context carries `navigation: undefined`. */
+   * Dashboard. Omitted, the context omits the member, as it did before navigation existed. */
   readonly navigation?: ModuleUiNavigation;
 }
 
@@ -361,8 +361,8 @@ export function createModuleUiContext(options: CreateModuleUiContextOptions): Mo
     moduleId: options.descriptor.id,
     permissions: Object.freeze({ has: (permissionId: string) => granted.has(permissionId) }),
     // Only a host with addressable module pages supplies navigation (ADR 0063); the display host
-    // shows one screen and supplies none.
-    navigation: options.navigation,
+    // shows one screen and omits the member entirely, exactly as before navigation existed.
+    ...(options.navigation === undefined ? {} : { navigation: options.navigation }),
     principal: options.principal,
     realtime: createModuleRealtimeClient(options.config, options.descriptor),
   });