feat: carry WebXR controller input as CDR

[TomCC7]

The embedded WebXR client still emitted legacy LCM fingerprints. It now serializes PoseStamped/Joy as canonical CDR inside the existing relay data-frame envelope; the server validates channel/type/encoding and exact frame length, then decodes using the installed generated registry. /teleop/schema supplies complete ROS2 dependency definitions, avoiding copied upstream schemas. Internal controller pose math and body-tracking JSON retain their contracts.

Linear: https://linear.app/dimensional/project/message-encoding-refactor-05a3ddb4af3e/overview

Parent: #4699. This is the WebXR ingress slice. Its typed output ports and downstream task/transport declarations remain the next slice; full WebXR/robot graph closure is not claimed. Old LCM command frames are rejected, with no fallback. Pinned browser imports are rosmsg5.0.5 and rosmsg2-serialization3.1.2, previously authorized. Ordinary browser use needs no Deno; Deno is only the offline test runner.

Category	Files	Additions	Deletions
Python ingress/schema endpoint	1	56	16
Browser encoder, client and import map	3	58	26
Existing behavior and browser interop tests	1	180	24
Runtime .mjs packaging	2	2	1
Installed-code CI definition	1	8	0

Offline manual behavior test, from this proposal checkout installed with its development/web test dependencies:

DIMOS_TRANSPORT=lcm LCM_DEFAULT_URL=memq:// python -m pytest --noconftest --import-mode=importlib -o addopts='' -q dimos/teleop/webxr/test_module.py dimos/teleop/webxr/test_body_tracking.py

Without Deno on PATH, the exact browser-encoder case explicitly skips. To include that case after the existing SDK frontend dependencies are installed:

DIMOS_WEBXR_CDR_DENO="$(command -v deno)" DIMOS_WEBXR_CDR_NODE_MODULES="$PWD/web/node_modules" DIMOS_TRANSPORT=lcm LCM_DEFAULT_URL=memq:// python -m pytest --noconftest --import-mode=importlib -o addopts='' -q dimos/teleop/webxr/test_module.py dimos/teleop/webxr/test_body_tracking.py

Expected with those tools: 68 passed. The exact shipped command_codec.mjs runs offline against the installed, version-checked Foxglove libraries; Python decodes its frames and handles both pose/joystick commands, including a one-nanosecond CDR stamp. The full shipped teleop.js is syntax-checked offline. Only dependency loading differs in the test (installed CommonJS loader versus browser ESM import map); no serializer logic is reconstructed. Original malformed-controller/unknown-hand/zero-velocity behavior assertions remain and now use real CDR fixtures.

Validation: 68 source and 68 isolated installed-wheel cases passed. Schema endpoint/static asset requests use TestClient; no HTTPS listener, headset or robot is started. Strict mypy passed the production module; scoped hooks and offline uv.lock consistency passed except unavailable Nix lint. Wheel SHA256 42eca7772950773271a407e25be384693b6df356e5efe5ecddf2e293eb7f2d8d; both command_codec.mjs and the existing webxr_body.mjs are present and actually served from the installed package. Added .mjs to both packaging extension lists after detecting they were omitted. Installed verification records the existing Starlette BlockingPortal deprecation and pytest anyio rewrite warning. Web-interface import dependencies were installed at repository-locked versions only in task test venvs/CI definition; no local system/media setup was changed.

No CI polling, benchmarks, physical operation, package registry publication or human XR acceptance. External CDN delivery/headset acceptance and the remaining outgoing/downstream migration are explicitly unverified.