Upgrade Calcit 0.27 and verify frontend COS assets

[tiye]

Scope

• Upgrade Calcit and @calcit/procs to 0.27.0, refresh locked modules, and migrate both entrypoints to strict checks.
• Build frontend assets with the COS CDN base; upload and publicly verify only dist/ through cos-upload-action v1.1.1.
• Keep the existing web rsync entry at /web-assets/repo/${{ github.repository }} and the separate service rsync destination at /servers/tabletwo/. No server artifact is sent to COS.
• Replace the old quality-baseline CI ratchet with current strict client/server checks; retain the baseline file for historical reference.

Local verification

• caps --ci; caps verify --toolchain (Calcit and @calcit/procs 0.27.0).
• yarn install --immutable on Node 24.
• Strict client and server --check-only.
• Client JS generation, Vite CDN build, and server IR generation.
• Deprecated API summaries: none; git diff --check.

Please review the Calcit source migration and deployment boundary before merging. The PR workflow will exercise public COS verification when repository secrets are available.