fix(build,denoise): gate node leak, postMessage origin, fail-hard patch, CDN dedup (N124/N125/N128/N120)

- N124: denoise shim cleanup() now disconnects the noise gate AudioWorkletNode
  (var-scoped, guarded), releasing the gate processor thread instead of leaking
  it on every getUserMedia within a session.
- N125: denoise-status postMessage now targets the parent origin (derived from
  the parentUrl widget param via new URL(...).origin, falling back to this
  frame's origin) instead of broadcasting with '*'.
- N128: patch-folds.mjs fails hard (process.exit(1)) when the patch target is
  missing, so an unpatched folds can't silently ship. The idempotent
  "already applied" path still exits 0 (verified by re-run).
- N120: the avatar-decoration CDN URL is now single-sourced in
  avatarDecorations.ts (DECORATION_CDN); syncDecorations.mjs extracts it by
  regex (can't import across the build/app boundary) and fails hard if renamed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/features/lotus/avatarDecorations.ts

@@ -1,3 +1,8 @@
+// Single source of truth for the avatar-decoration CDN base URL.
+// scripts/syncDecorations.mjs reads this exact `DECORATION_CDN` declaration out
+// of this file at runtime (by regex) instead of re-declaring it, so the two can
+// never drift. If you migrate the CDN, change it here ONLY — keep the
+// `export const DECORATION_CDN = '...'` shape so the sync script can still parse it.
 export const DECORATION_CDN =
   'https://drive.lotusguild.org/public.php/dav/files/bHswJ9pNKp2t26N/cinny-decorations';