feat(sse,tui): bump spec pin to v0.28.0 + AffectUpdate event (v0.11.0)

Spec pin moved 55101e9 (v0.19.0) → da93ca7 (v0.28.0); vendored
conversation-api-spec.md + conversation_api.contract.md re-snapshotted
from Worldtree at the new SHA. The only material delta consumed in
this bump is Worldtree #204's affect_update SSE event surface.

Wire layer (sse_client.py):
- New AffectUpdate dataclass: sse_id / status / turn_id / snapshot
  (snapshot is None for status="scheduled")
- Added to Event union + _envelope_for_type dispatch branch
- Without this, ratatoskr would crash on any persona-enabled turn
  from a v0.28.0 server (unknown SSE event type → ValueError)

TUI layer (tui.py):
- AffectUpdate routes through the v0.10.0 audit pipeline only — one
  debug-pane line per arrival with dominant_emotion + PAD for
  status="current", lightweight status+turn_id for status="scheduled"
- No transcript / tools / thinking pane writes — the persona UX shape
  (Persona TabPane vs sticky header line) is deferred to a separate
  bump pending operator direction

Tests: 2 new wire-layer tests for current+scheduled parsing + 2 new
presenter audit tests for routing and audit-line shape.

Not yet consumed: GET /agents/{id}/persona_state endpoint (step 2 of
the integration plan).

docs/conversation_api.contract.md

@@ -1851,6 +1851,36 @@ SQLite `consumer_agents` table.
   before any other processing; non-slug user_ids return 403
   `tier3_user_id_unsupported`.
 
+### Persona-state observability (issue #204)
+
+- **INV-204-1 (affect_update event type)**: `affect_update` is a
+  top-level SSE event `type` discriminator, sibling to `worker_phase`
+  / `tool_*` / `text` / `thinking` / `done`. Not a `worker_phase` sub-
+  phase. INV-061's "BuildingPrompt is the FIRST event" property is
+  scoped to `worker_phase` events only — `affect_update status="current"`
+  may precede BuildingPrompt for persona-enabled agents.
+- **INV-204-2 (per-turn emission)**: For agents with persona enabled
+  on non-ephemeral sessions, `stream_turn` emits `status="current"`
+  before any other SSE event on a successful or failed turn, and
+  `status="scheduled"` after `update_after_turn` schedules the
+  appraisal task (success path only — skipped on cancel / error
+  before update_after_turn was reached). See contract
+  `docs/contracts/issues/204.contract.md`.
+- **INV-204-3 (emission suppression)**: Persona-disabled agents and
+  ephemeral sessions emit ZERO `affect_update` events.
+- **INV-204-6 / INV-204-7 (persona_state endpoint)**: New
+  `GET /agents/{agent_id}/persona_state` gated on Heimdall scope
+  `persona.read`. Route ordering: auth → Tier 3 short-circuit (404
+  `persona_not_configured`) → Tier 1/2 existence (404
+  `agent_not_available`) → persona-enabled check (404
+  `persona_not_configured`) → snapshot (200).
+- **INV-204-9 (read-only registry primitive)**: `PersonaRegistry.get_state`
+  is mutex-free and never mutates `persona.emotions`. Eventual
+  consistency under concurrent `_appraisal_wrapper` mutations.
+- **INV-204-14 (replay participation)**: `affect_update` events flow
+  through `_publish`, so SSE resume / replay handles them with no
+  special case.
+
 ### Storage extension
 
 The `consumer_agents` table lives in `core/heimdall/storage/sqlite.py`