[codex] Harden native control QA flows

[mefree2098]

Summary

• documents the native Zigbee/Z-Wave/Thread/Matter QA pass and live safety boundaries
• blocks executable migration steps for cloud-only SmartThings helper devices
• adds backend coverage for native radio/Matter command routing and workflow execution
• clarifies web and iOS migration UX, plus fixes dense desktop device card wrapping

Validation

• NODE_ENV=test node --test server/tests/directRadioDeviceCatalog.test.js server/tests/deviceService.test.js server/tests/workflowExecutionService.test.js
• node scripts/run-with-modern-node.js npm --prefix server test
• node scripts/run-with-modern-node.js npm --prefix client run build
• xcodebuild -project HomeBrainApp/HomeBrainApp.xcodeproj -scheme HomeBrainApp -destination "platform=iOS Simulator,name=iPhone 17,OS=26.5" build
• live HomeBrain direct-radio/Matter status, safe inclusion/exclusion windows, Chrome/web/iOS visual QA recorded in docs/qa/native-control-qa-2026-05-17.md

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ef95864bc7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Return explicit blocked workflow metadata

For cloud/virtual devices this now returns guidedSteps: [] and instructionProfile: null, but existing migration starters treat an empty guided-step list as a malformed plan rather than a supported block path (the iOS flow throws URLError(.cannotParseResponse) and the web flow raises a generic “could not build workflow” error after fetching the plan). This is user-visible when an unsupported device migration is attempted before the UI has fully switched to the blocked state, so the API should keep a non-executable placeholder step or provide an explicit machine-readable blocked reason that clients can render directly.

Useful? React with 👍 / 👎.