[Feature] RubyUI 2.0 — Phase 2.0a: the component layer, the harness and the suite's new lanes

[cirdes]

What

Stacked on #536. Puts the 2.0 foundation into the gem with every component
still Phlex:

• RubyUI::Component and RubyUI::Attributes — the 2.0 layer from the v2
  gate, promoted: plain Ruby, ERB sidecar found under RubyUI.component_roots
  through a lookup scoped to the root that holds the class file (a host
  template at the same virtual path is not picked — tested), content reset
  on every render, Phlex 2.4.1's attribute guards ported (an unsafe name
  raises, a javascript: URL is dropped — tested, and a runtime differential
  test pins the serialization against Phlex itself), and an enum helper that
  coerces "lg"/:lg and names the allowed values on anything else.
• The harness — the gem's tests boot an inline Rails::Application so
  ReActionView compiles every template through Herb exactly as a host app
  will; a malformed template is refused at compile time.
• The golden suite's ERB lane — a scenario may have an ERB fixture,
  rendered and compared against the same frozen snapshot. With phlex-rails
  loaded a fixture renders a still-Phlex component, so all 188 fixtures can be
  green before any migration. Button's 15 are here as the proof.
• The strict lane — the canonical form in preserve mode, with one snapshot
  per scenario (188), recorded from Phlex.

No component migrates. Nothing under gem/lib/ruby_ui/<component>/ changes;
the 188 golden snapshots are byte-identical to #536. No runtime dependency is
added — every new gem is development-only, and phlex-rails leaves with the
last Phlex component.

Why

Phase 2.0 of design/2026-09-19-rubyui-2-0-design.md. The five mechanisms the
spec deferred to this phase are decided in design/v2/decisions.md entries 5–9.

Test steps

cd gem
bundle exec rake            # 596 runs, 0 skips; 423 files, no offenses
bundle exec rake golden     # 234 runs: 188 Phlex-lane + 15 ERB-lane + 6 coverage + 25 of the ruler's own

To see the ERB lane work, edit test/golden/views/button/size_md.html.erb to
render size: :lg and re-run rake golden.

🤖 Generated with Claude Code

---

Summary by cubic

Puts the RubyUI 2.0 foundation into the gem — RubyUI::Component and RubyUI::Attributes — while every shipped component still renders through Phlex, so the 188 golden snapshots stay byte-identical to the previous phase. No runtime dependency is added; every new gem is development-only.

Component layer

• RubyUI::Component is a plain Ruby object ActionView renders via render_in, looking its ERB sidecar up only under the RubyUI.component_roots entry that holds the class file; host view paths are never consulted.
• RubyUI::Attributes ports Phlex 2.4.1's serialization and guards — unsafe names raise before their value is read, so a nested hash under onclick or srcdoc raises too, and javascript: URLs are dropped — pinned by a runtime differential test against Phlex.
• The enum helper coerces "lg"/:lg to the same table key and raises naming the allowed values otherwise.

Harness and golden suite

• Tests boot an inline Rails::Application with RAILS_ENV pinned to test, so ReActionView compiles every ERB template through Herb as a host app will and refuses malformed templates at compile time.
• A scenario may have an ERB fixture under test/golden/views, rendered through the same harness and compared against the same snapshot; with phlex-rails loaded a fixture renders a still-Phlex component, so all 188 fixtures can be green before any migration.
• The strict lane pins the preserve-mode form — text verbatim, whitespace kept, only HTML whitespace trimmed at the edges — for every scenario, so a migrated component that adds a newline where Phlex emitted none fails even though the canonical form cannot see it.
• The merged custom-keybindings scenario fix re-pins that strict snapshot to keydown.ctrl+p@window.
• The spec, implementation plan, decision log entries 5–9, and follow-up issues 8–11 (opened as Switch is neither perceivable nor operable by assistive technology #550–Link carries type="button" on an <a> #553) record what this phase decided.

^{Written for commit f855423. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 241 files

<sub>Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Re-trigger cubic</sub>