feat(keystone): add native investigations, scoped runs and canvas

[VibeSWE]

Description

Native Keystone previously showed a capability notice. This adds private, durable investigations: users save a question as a draft, explicitly run it against an approved dataset/time scope, inspect evidence and progress, and create follow-up or Explore cards from a completed direct parent.

• Native Rust coordinator with immutable context/export hashes, durable idempotency, separate semantic/layout revisions, authenticated event replay, cancellation accounting, and interrupted-run recovery. Tenant/owner and current credential/RBAC checks apply at dispatch, including after queued repository work.
• Bounded read-only DataFusion schema/sample operations and named-tenant cold-catalog loading. Ordinary queries retain the original manifest decoder. Shared query, storage and session-expiry changes have regression coverage.
• Destination-bound encrypted local credentials and OpenRouter answer generation with explicit no-data-collection/ZDR routing, pinned DNS addresses, bounded transport, and independent credential-save capacity. Jev/Luna decision interfaces remain separate and disabled.
• React Flow canvas, user-triggered Auto format, keyboard/mobile branch reader, evidence/context inspectors, run links/progress/reconnect, and clear readiness/classic-UI fallback states. Layout changes never run a model or change context.

Child context contains only the selected direct parent's versioned own prompt, completed answer, approved scope and explicitly exported authorized evidence, plus the child prompt and system/tool instructions. It does not inherit sibling or hidden ancestor transcripts or provider-held conversation state.

Validation

Validated from isolated source snapshots; production source matches the final reviewed snapshot. Independent Opus reviews found no remaining blockers in the reviewed scope.

Check	Result
Rust library suite	807 passed, 1 existing ignored benchmark; includes 136 Keystone tests
Rust formatting, library/binary check and embedded binary build	Passed
Default strict Clippy	Passed
CI feature-by-feature Clippy	All 7 runs passed with the local compiler settings below
Full frontend npm run check, pinned Playwright CI container	Passed
Frontend unit tests	2,483 passed, 14 skipped
Browser UI tests	557 passed, 1 passed on retry, 2 skipped
Production browser tests	24 passed
Storybook tests, including screenshots	293 passed, including 60 Keystone cases

The redundant lightweight Rust harness was retired before committing: all 91 test functions it imported, including every name from its historical 73-test result, are present in the main suite. A fresh post-retirement run passed all 136 Keystone tests. No coverage was removed or hidden behind conditional skips.

Deployment and validation limits

• Opt-in, one designated coordinator with local durable storage and a deployment-supplied encryption master key. File locking is not distributed fencing; do not enable independent coordinators on every query replica.
• Generation analyzes bounded samples, not exhaustive statistics or an autonomous SQL/tool loop. Answers arrive whole; SSE streams committed progress. The cheap configured model may have no endpoint satisfying privacy and price requirements; requests fail closed. No paid calls were made for this validation.
• Cancellation retains top-level query accounting through teardown. Independently bounded DataFusion child tasks and blocking decode/file work can briefly outlive it; teardown-pending states retain their reservation. The docs describe this limit, request-body zeroization limits, and non-atomic revocation during response transmission.
• All-target Clippy still reports 11 errors reproduced on the base commit. The actual feature CI gate passed locally using CFLAGS=-std=gnu17, CMake 3.31.8, and CMAKE_POLICY_VERSION_MINIMUM=3.5 for GCC 16/bundled Kafka dependencies. These were environment overrides, not repository changes.
• The embedded build used real native UI assets and a classic-UI placeholder; the pinned classic bundle was not validated. One existing APM timing test passed on retry. Host screenshot differences disappear in the CI container.
• This PR does not deploy or restart the local test instance. Repository CI should confirm the checks before moving the draft to ready.

Reviewer guide

Start with foundation and deployment contracts, then provider/security behavior and browser validation. Backend domain/context/repository/coordinator code is under src/keystone; native query integration changes are in catalog/query/storage/RBAC. UI components and fixtures are under frontend/src/features/keystone, with strict transport contracts under frontend/src/lib/keystone.

This PR has:

• been smoke-tested for ingestion and query on the final running server build (isolated automated query tests passed; final live-server restart is pending).
• added comments explaining non-obvious intent and security boundaries.
• added documentation for new features, deployment inputs and known limits.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[comment-clanker]

Independent review of head 1bf6a86122fe4eea348022c1c4163da880136eb4 against base bd20b0431ab2e5a50d8e159bb01ae19f72487778, with Opus 5.5 and Sol 6.1 reviewers. One confirmed frontend cancellation-contract defect is detailed below. The scoped backend review found no additional material defects.

Validation: rebuilt this head and ran the Rust Keystone tests (136 passed); independently reproduced the adapter failure with synthetic responses. Frontend browser suites and live provider inference were not run for this review.