feat: #3590567 Add a confirmation step before resetting a Canvas layout

Summary

Adds a confirmation before a per-content Canvas layout is reset. Previously the Reset Canvas layout tab was a one-click GET link, so a layout could be cleared by accident — and the action ran without CSRF protection.

What changed

The Reset Canvas layout local task now confirms before it resets, using Drupal core's HTMX integration (core/htmx, Drupal 11.x):

• The task carries hx-confirm (the browser's native confirmation prompt) and hx-post to a dedicated reset endpoint, with a CSRF token in the URL. On confirmation the endpoint clears field_canvas_layout, sets a status message and returns an HX-Redirect back to the content. No dialog markup, JavaScript or CSS is added by the module.
• core/htmx is attached from the node build (hook_entity_view_alter) for users who can see the task, so it survives admin themes (Gin/Mercury, vartheme) that re-render the local tasks.
• No-JS fallback: the task's href opens a standard ConfirmFormBase page (CanvasResetConfirmForm), so the behaviour degrades gracefully and still runs through an explicit confirmation and a POST with a CSRF token.

Files

• src/Controller/CanvasResetController.php — HTMX reset endpoint (POST, CSRF), returns HX-Redirect.
• canvas_override.routing.yml — canvas_override.node.canvas.reset.do POST route (_csrf_token: 'TRUE'); the existing reset route stays as the no-JS confirm form.
• src/Hook/CanvasOverrideHooks.php — the Reset task posts via HTMX; the core/htmx library is attached from the node build.
• src/Form/CanvasResetConfirmForm.php — no-JS fallback confirmation page.
• Tests + docs updated; the acceptance suite answers the native confirm (accept / dismiss).

Why HTMX (not a jQuery-UI dialog)

A jQuery-UI modal opens on the front-end theme, which does not load the admin dialog CSS, so the dialog title and close button render inconsistently per theme. The HTMX + native-confirm approach has no dialog chrome to theme — it looks and behaves identically on every theme and adds zero module CSS.

Verification

Verified through the browser on fresh Drupal core (Olivero), Drupal CMS (Mercury) and Varbase 11.0.x (vartheme_bs5) builds: the confirmation prompt appears, confirming resets the layout and returns to the content with the status message. Acceptance suite passing — Drupal core 41, Drupal CMS 18 — and gitlab-ci-local (cspell, eslint, dry-run, pages) all pass.

AI usage disclosure

Per the Policy on the use of AI when contributing to Drupal: AI-Generated: Yes. Claude Code (Anthropic) implemented the HTMX confirmation flow, the reset endpoint and the no-JS fallback. All of it was reviewed, run against live Drupal core, Drupal CMS and Varbase sites, and verified by the contributor, who takes full responsibility for the submission.

Checkpoints:

• File an issue
• Addition/Change/Update/Fix
• Testing to ensure no regression
• Automated unit testing coverage
• Automated functional testing coverage
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Documentation
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release