Preselect requested channel services on first entry

[AbigailDeng]

When a Channel Bind or Edit URL contains requiredServiceId, the form now preselects the exact active, account-available services on first entry. Previously these rows only displayed Requested and needed a manual click. Existing saved selections and built-in required services are retained; binding or saving still requires an explicit user action.

Defaults apply once, after the first successful fresh inventory. Initial failures may retry. Subsequent refreshes, new availability, rerenders and query changes do not reselect services that the user removed or apply new URL defaults. Manual edits made from cached inventory while the first refresh is pending also take precedence. A different bot/registration or a full page reload creates a new entry. Missing, inactive and account-denied IDs are never selected; matching a slug does not substitute another instance. Login-time service grants remain independent of the account inventory.

Scope and documentation

The change is confined to the shared Channel configuration form, its Bind/Edit route tests and apps/aevatar-console-web/docs/superpowers/specs/2026-09-28-channel-service-access.md. It needs no new backend contract and does not restore the withdrawn Skill recommendations.

This PR is for user review and local testing. Do not merge or deploy without explicit user authorization.

Local verification

Passed: 4 related suites / 26 tests across focused runs, changed-file Biome (3 files), test stability guards and whitespace checks. The initial run passed 25 tests; two asynchronous refresh assertions in the Edit suite were corrected to wait for the rendered inventory instead of reading before Query notification. The final rerun passed all 4 Edit access tests. Production implementation did not change during those test corrections.

python3 /Users/abigaildeng/.codex/skills/frontend-incremental-pr/scripts/frontend_change_scope.py --repo . --base origin/feat/2026-08-04_workflow-activity-vnext
pnpm --dir apps/aevatar-console-web exec jest --listTests --runInBand --findRelatedTests src/pages/workflow-activity-vnext/channels/ChannelConfigurationPage.tsx
pnpm --dir apps/aevatar-console-web exec jest --runInBand --runTestsByPath src/pages/workflow-activity-vnext/channels/ChannelBindServiceAccess.test.tsx src/pages/workflow-activity-vnext/channels/ChannelServiceAccess.test.tsx src/pages/workflow-activity-vnext/channels/ChannelEditPage.test.tsx src/pages/workflow-activity-vnext/channels/ChannelDefaultSkill.test.tsx
pnpm --dir apps/aevatar-console-web exec jest --runInBand --runTestsByPath src/pages/workflow-activity-vnext/channels/ChannelServiceAccess.test.tsx
pnpm --dir apps/aevatar-console-web exec biome check src/pages/workflow-activity-vnext/channels/ChannelConfigurationPage.tsx src/pages/workflow-activity-vnext/channels/ChannelServiceAccess.test.tsx src/pages/workflow-activity-vnext/channels/ChannelBindServiceAccess.test.tsx
env PATH="/opt/homebrew/opt/python@3.12/libexec/bin:$PATH" bash tools/ci/test_stability_guards.sh
git diff --check

Dependency discovery found the four Channel suites above plus the broad vNext index suite. The latter also covers unrelated workflow/settings domains and is delegated to GitHub CI. Full frontend suite, typecheck and production build are delegated to GitHub CI by personal local validation policy. No reliable repository-native affected typecheck is available.

Browser verification used the authenticated local console on port 5199 against the configured remote backend and an actual unbound bot. An exact Firecrawl UserService URL hint was checked on entry; deselecting and filtering preserved the user's choice. No bind/save was submitted.

Design baseline

• Baseline: apps/aevatar-console-web/docs/design-baselines/workflow-activity-vnext/
• Primary: aevatar-workflow-activity-vnext.excalidraw
• SHA-256: 30e74d7b410ae72c4c91432355436679033679c54c10b1702908435b001577de
• Contract: apps/aevatar-console-web/docs/superpowers/specs/2026-08-04-workflow-activity-vnext-design.md
• User paths: apps/aevatar-console-web/docs/superpowers/specs/2026-08-04-workflow-activity-vnext-user-paths.md
• Keep the existing compact Channels form, typography, tokens and Requested badge. Production data comes from real APIs and acknowledged actions; fixtures remain test-only. Existing auth, identity and localization remain authoritative.