test(e2e): sprint 5 acceptance tests — US-26 → US-28 + dropdown adaptations

Add three new spec files:
- us26-templates-crud: API CRUD (AC-26.3–26.7) + UI list/form/delete/redirect (AC-26.8)
- us27-instantiate-from-template: template_id copy + name override + 404 + decoupling
  (AC-27.1–27.3) + no auto-transition/engagement-activate (AC-27.4–27.5) + dropdown
  UI + picker modal + empty state + SOC gate (AC-27.6–27.7)
- us28-templates-nav: Templates link admin+redteam only, SOC redirect, form editable (AC-28.1–28.3)

Adapt sprint 2/3 e2e for sprint 5 dropdown:
- us4-engagements: getByRole link "New simulation" → getByTestId "new-simulation-btn"
- us7-simulation-create: same — split-button dropdown replaced the link

Suite: 201 passed (1 pre-existing flaky in us3 re DB state, unrelated to sprint 5).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

e2e/tests/us7-simulation-create.spec.ts

@@ -156,15 +156,13 @@ test.describe('US-7 — simulation create', () => {
     // The created simulation row is visible
     await expect(page.getByRole('row', { name: /Visible sim/i })).toBeVisible();
 
-    // "New simulation" button visible for redteam
-    await expect(
-      page.getByRole('link', { name: /new simulation/i }),
-    ).toBeVisible();
+    // Sprint 5: "New" is now a split-button dropdown (data-testid="new-simulation-btn")
+    await expect(page.getByTestId('new-simulation-btn')).toBeVisible();
 
-    // SOC should NOT see "New simulation" button
+    // SOC should NOT see "New simulation" dropdown
     await seedTokenInStorage(context, socToken);
     await page.goto(`/engagements/${engagementId}`);
-    await expect(page.getByRole('link', { name: /new simulation/i })).toHaveCount(0);
+    await expect(page.getByTestId('new-simulation-btn')).not.toBeVisible();
 
     await deleteSimulation(redteamToken, sim.id);
   });