Bump frontend pin: gate audit entry on command availability

Why: the rdm-audit entry must hide on plain bases lacking rdm.inspect.*
commands (2026-10-12 diagnostic, increment 2), and the dev-repo e2e driver
needs a plain-base phase to prove it end to end.

Evidence: frontend e058adc carries the gating (vitest 23 files / 112 tests
incl. new contract matrix; tsc -b && vite build pass); full e2e rerun
follows this commit (RDM combo + plain base phases).

Impact: modules/frontend pin 360d640 -> e058adc; scripts/e2e.sh gains
phase 4 (same $DATA served by the base CLI, plain-base.playwright.ts);
task card records scope, authorization chain and stage table.

Refs: 2026-10-12 diagnostic report, increment 2.

scripts/e2e.sh

@@ -78,6 +78,7 @@ cleanup() {
   [ -n "${UI_PID:-}" ] && kill "$UI_PID" 2>/dev/null || true
   pkill -f "vite preview --port $UI_PORT" 2>/dev/null || true
   pkill -f "agent-system-rdm -data.*e2e" 2>/dev/null || true
+  pkill -f "agent-system serve .*$API_PORT" 2>/dev/null || true
 }
 trap cleanup EXIT
 (cd "$RDM_WT" && go build -o "$OUT/agent-system-rdm" .) || die "rdm build failed"
@@ -220,4 +221,26 @@ set -e
 cat "$OUT/playwright.log"
 [ "$PW_EXIT" = 0 ] && log "PASS" || die "playwright exit=$PW_EXIT (log: $OUT/playwright.log, trace: $OUT/frontend/test-results/)"
 
+# ── 4. 普通基座缺能力场景（增量 2 验收）──────────────────
+# 同一 $DATA 换基座 CLI 服务（与 RDM 二进制同源同 pin，命令面无 rdm.inspect.*），
+# preview 不动只换 /api 指向，跑 plain-base spec：审计入口隐藏、代理常驻、
+# 全程无 rdm.* 命令请求——消除「入口可达、进入即 400」的原缺陷路径。
+log "plain-base phase: serve base CLI (no RDM commands)"
+stop_serve
+"$OUT/agent-system" serve --data "$DATA" --addr "127.0.0.1:$API_PORT" --auth on \
+  >"$OUT/serve-plain.log" 2>&1 &
+API_PID=$!
+for i in $(seq 1 40); do
+  CODE=$(curl -s -o /dev/null -w '%{http_code}' "$API_BASE/api/me" || echo 000)
+  [ "$CODE" != "000" ] && break
+  sleep 0.25
+  [ "$i" = 40 ] && { tail -5 "$OUT/serve-plain.log"; die "plain api not ready"; }
+done
+set +e
+npx playwright test e2e/plain-base.playwright.ts --reporter=list >"$OUT/playwright-plain.log" 2>&1
+PW_PLAIN_EXIT=$?
+set -e
+cat "$OUT/playwright-plain.log"
+[ "$PW_PLAIN_EXIT" = 0 ] && log "PASS (plain-base)" || die "plain-base playwright exit=$PW_PLAIN_EXIT (log: $OUT/playwright-plain.log)"
+
 log "done; artifacts in $OUT"