Why: Core #27/#28 landed the surface snapshot types and the
surface.updated union entry; the backend dep copy must match Dev's
modules/core pin or check-pins fails.
Evidence: scripts/check-pins.sh + combined make test in the Dev
workspace after re-pinning.
Impact: Gitlink bump only.
Refs: Core PR #27/#28; Dev task feature/generative-ui-u4