Sandboxes, MCP tools, and MCP servers each modeled their list rows and
detail headers differently. Collapse them — and the surfaces they drifted
from — onto one set of primitives.

SettingsResourceRow now owns the row entirely: tile, title/subtitle tokens,
padding and bleed, hover band, hit area, focus ring, and the one navigation
chevron. Adds onClick/href (a stretched overlay, so interactive trailing
controls keep their clicks), navigable, iconVariant='custom', and a badge
slot for decoration that must not swallow row clicks.

Rows that open a detail page get a chevron and a whole-row click; flat
records keep the "..." menu. Delete moves to the detail header as a
destructive chip behind a confirm modal — sandboxes previously deleted with
no confirmation at all.

Also folds in SettingsField (new), SettingsEmptyState tone='error',
RESOURCE_LIST_STACK/GRID, RESOURCE_TILE_PLAIN, and a shared MemberAvatar;
deletes DetailIconTile (byte-identical to ResourceTile); and standardizes
on the emcn ArrowRight, which is a visibly different glyph from lucide's.

…seeding

Follow-up from review of the consolidation.

The sandbox delete confirmation was boolean-only state. Browser Back unmounts
the modal without closing it, so opening another sandbox re-opened it already
confirmed — against the wrong sandbox. Reset it where the draft guard already
handles the same history hazard.

RESOURCE_LIST_GRID kept an 8px column gap after the bleed moved onto the row,
so neighbouring cards overlapped by exactly the gutter and the right-hand card's
stretched hit area won it: clicking between two cards opened the wrong one.
Budget the gap for the bleed instead.

Also: restore the `group` the template-icon hover outlines depend on; add a
`flush` row for headings and overflow boxes; seed MemberAvatar identically on
every surface; keep the MCP transport label visible in all row states; give the
Delete chip a stable id so it doesn't remount mid-delete; and stop an empty
subtitle rendering a phantom line.

Docs: widen the rule's path globs to the surfaces it now governs, drop the
`text-[14px]` example that contradicted the token rule, and add a Mode C for
migrating rows onto the primitive.

Consolidating the Teammates/Organization avatar onto the credential member
row's was a redesign, not a deduplication. The two encode different things:
the roster is a dense list keyed on email where the avatar is a 14px neutral
marker, while a member management row carries a name, an email, and a role
control and earns a 36px hashed avatar.

Merging them made those rows ~70% taller, gave every workspace in a permission
group a colour-hashed "avatar" seeded on its name, and cut the Add Members
picker from ~7 visible rows to ~5 inside its fixed-height box.

Restores both avatars and the containers that owned their bleed, and records
in the rule why they stay separate. Keeps only the unrelated fix in that area:
the picker row was the one settings row rounded at `sm`.

Final review round. Two fixes the previous commit claimed but did not land:
`CredentialDetailHeading` never passed `flush`, so every credential detail
heading wore list-row padding, and the empty-subtitle guard was never applied.
Both were scripted replacements that silently no-op'd.

RESOURCE_LIST_GRID also dropped to one column 32px earlier than the grid it
replaced — `auto-fit` measures tracks, not margin boxes, so widening the gap
for the rows' bleed moved the breakpoint. Track minimum now budgets for it.

Removes the BYOK skeleton rather than maintaining a second copy of the row: it
was the only skeleton in settings, and it had already desynced from the row it
imitates. Its peers render nothing while loading.

Also: unify the glyph-tile treatment across MCP/sandboxes/workflow-MCP with
custom tools; move decoration out of `trailing` in verified-domains and
recently-deleted; convert the last hand-rolled row and empty states in
workflow-MCP, api-keys, copilot and group-detail; give copilot's delete the
same `...` affordance as api-keys; announce the row description via
aria-describedby, which the stretched overlay had silenced; and let
SettingsField render its own value so callers stop restating type tokens.

Docs: correct claims that predate this PR — `aside` does not exist, the
navigation source of truth is under components/, beforeunload mounts in the
layouts, `getSettingsSectionMeta` takes two args — and stop asserting a
literal-pixel grep returns zero when display type legitimately uses it.