D-30: freeze QATaskInboxProps as v1.0.0 public ABI

---
feature_id: FEAT-studio-qa-projects
---

> D-30 ticket 1: freeze QATaskInboxProps v1.0.0 ABI + customization enum. Target FEAT-studio-qa-embed-contract (child).

## Context

(PDT decision-memo lineage; see source line below.)

**Source: PDT D-30 (Studio QA external product surface), ticket 1 of 3.**

## What
Freeze `QATaskInboxProps` as v1.0.0 public ABI. Publish contract spec at `docs/platform/qa-embed-contract-v1.md`.

## Customization enum (Marisol veto scope)
Restrict customization to:
- `brandName: string` (host product's display name)
- `logoUrl: string` (URL to host logo image)
- `accentColor: string` (hex or CSS color)

Explicitly NOT allowed:
- Arbitrary React `children` on QATaskInbox
- `dangerouslySetInnerHTML` anywhere
- Server-rendered strings passed from host BFF into embed slots

The embed's own text (test case titles, step instructions) is Studio-owned per `notify.ts` PHI floor. Marisol reviews customization enum in the PR before this ticket merges.

## Lifecycle callbacks (from D-28 scope)
- `onRunStart(runId)`
- `onResultSubmit(result)`
- `onCommentAdd(comment)`

## Acceptance Criteria
- [ ] `QATaskInboxProps` frozen at v1.0.0 with customization enum
- [ ] `docs/platform/qa-embed-contract-v1.md` documents shape + PHI boundary
- [ ] Type-level test that customization slots reject arbitrary React nodes

## Feature
FEAT-studio-qa-embed-contract (add via feature-map + depmap two-PR sequence FIRST)

## Blocked-by
None.

## Size / Band
SMALL / assurance.