No-HMR fallback: fetch raw source and inject variants into DOM

For dev servers without HMR (Bun static imports, simple HTTP servers),
the browser can't see file changes automatically. Three changes fix this:

1. /source endpoint on live server: reads a project file from disk,
   gated by session token + path-traversal guard. The browser fetches
   the raw HTML directly, bypassing the dev server's cache.

2. poll --reply --file flag: agent passes the source file path when
   replying done. The browser receives it via WS and knows where to
   fetch. Skill reference updated to always include --file.

3. Browser injectVariantsFromSource(): on "done" with 0 DOM variants,
   fetches the raw HTML from /source, parses with DOMParser, extracts
   the variant wrapper, finds the matching element in the live DOM by
   class/ID, and replaces it. MutationObserver picks up the injected
   variants and the cycling bar appears.

Also: wrap CLI no longer hides the original element (was display:none).
The original stays visible until the first variant arrives, preventing
a flash of empty content between wrap and variant insertion.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

source/skills/impeccable/reference/live.md

@@ -136,10 +136,14 @@ The first variant should NOT have `style="display: none"` (it should be visible
 
 ### Step 3: Signal completion
 
+Include `--file` so the browser can fetch variants directly if the dev server lacks HMR:
+
 ```bash
-npx impeccable poll --reply EVENT_ID done
+npx impeccable poll --reply EVENT_ID done --file RELATIVE_PATH
 ```
 
+The file path should be relative to the project root (e.g., `public/index.html`, `src/App.tsx`).
+
 ## Handle Accept
 
 The event contains: `{id, variantId}`.