feat(13-09): retarget AIUI build/deploy to the in-repo aiui/ tree (D-19)

Finishes the 13-09 build-aiui.sh WIP checkpoint (30b2e02f) that survived the
operator reboot ground-truthed and confirmed correct: require_base_path,
frozen-lockfile install, verify_dist's asset-href/commit-attribution checks
all verified working against a real build. Fixed one grep-forbidden leftover
(a comment mentioning the retired scripts/aiui.pin path).

Rewires both AIUI sections of deploy-to-target.sh (primary --live path and
the --both/secondary path) and setup-aiui-server.sh to build/deploy from
aiui/packages/app/dist instead of the retired ../AIUI sibling checkout:

- Primary section now calls scripts/build-aiui.sh instead of an inline
  `pnpm build`, then scripts/verify-aiui-deploy.sh after the copy. The
  demo/aiui/ fallback now prints a loud, unmissable warning naming that it
  is shipping a checked-in dist rather than a fresh build.
- Secondary/--both section retargeted to the in-repo dist path; its
  fallback-to-.228-streaming behavior is otherwise unchanged.
- setup-aiui-server.sh calls scripts/build-aiui.sh automatically when the
  dist is missing or stale, instead of printing a manual `cd ../AIUI/...`
  command and exiting (D-15: enforced, not remembered).

No remaining `../AIUI` reference in either script.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/build-aiui.sh

@@ -5,10 +5,10 @@
 # D-19 (2026-08-03): AIUI is no longer a second repository at
 # git.tx1138.com/lfg2025/AIUI. It was migrated in-repo to aiui/ via
 # `git subtree`, full history intact. There is no second checkout to clone,
-# no `scripts/aiui.pin` to read or write, and no dirty-second-tree refusal
-# to perform — this repo's own ordinary commit discipline is what keeps its
-# history honest now, not a second-repo-specific check. D-15's *delivery*
-# half still stands and is what this script enforces:
+# no separate per-repo pin file to read or write, and no dirty-second-tree
+# refusal to perform — this repo's own ordinary commit discipline is what
+# keeps its history honest now, not a second-repo-specific check. D-15's
+# *delivery* half still stands and is what this script enforces:
 #
 #   - VITE_BASE_PATH must be exactly /aiui/. A wrong value produces a BLACK
 #     PAGE when embedded — the router base breaks, not the assets (this has