fix: expose promoted template media slots - #3483

The promoted-template contract change is internally consistent at this exact head.

• registryBlocks.test.ts:43-89 now pins the two safety invariants at the promotion boundary: no fixed video elements and no declared image variable without a consumption site.
• share-sheet-carousel.html:11-15,210-283 binds each product image to both its foreground slide and matching blurred background, plus the logo, through the runtime media-only data-var-src path.
• message-thread-reveal.html:5-24,1109-1195 exposes the complete narrative while applying replacements with textContent or direct text-node updates; the card image and closing logo use declarative media bindings, leaving messaging chrome untouched. Notification Cascade and AI Chat Reveal expose only their closing-card logo slots.
• heygen-avatar-promo-card/registry-item.json:4 removes promotion eligibility without deleting the template, matching the contract-v1 inability to replace its dominant MP4 assets.

Audited: the four edited composition HTML files and TEMPLATE contracts; their registry variable manifests; the promotion-safety test; avatar promotion-tag removal; the HFI #655 pin/list seam.

Trusting: generated catalog MDX/index/vector artifacts and the reported full browser/render validation.

All current OSS checks are green. The internal pin must still follow the stated order: publish immutable artifacts for this commit and pass the shared-dev E2E before #655 lands. No merge action.

Verdict: APPROVE
Reasoning: the brand-owned media/narrative slots are complete and safely bound while protected application chrome and fixed-video promotion boundaries remain enforced. — Magi