Add governed program visualization profiles

[abrichr]

What changed

This upgrades the offline visualizer into a program workbench. It uses declared edges for branches and loops. It also adds map, evidence, and stop-rule views.

Four projection profiles control what leaves the local boundary. The public and remote profiles keep topology but remove local evidence values, target text, selectors, URLs, and provenance.

The renderer remains plain HTML, CSS, and SVG. It doesn't add a graph runtime dependency.

Validation

• 16 visualizer tests
• Ruff checks
• Browser visual review

[abrichr]

Reviewed from the diff. The four-profile idea is right and _safe_title / _safe_halts are the correct shape — they construct safe strings from a fixed vocabulary rather than trying to scrub unsafe ones. But project_program_graph does not follow that shape, and one field leaks today.

The leak

projected = spec.model_copy(deep=True)   # copies everything
projected.bundle.provenance.content_digest = None
projected.bundle.provenance.source_recording_sha256 = None
projected.bundle.provenance.policy_name = None
for node in projected.nodes:
    node.title = _safe_title(node)
    node.param = None
    ...

This is a deny-list over a full deep copy. Whatever is not named survives into remote-safe and public-synthetic.

GraphNode.risk_explanation is not named. From ir.py:1005 it is a free-text field, max_length=512, described as:

"Why the compiler or qualifying operator assigned this risk. This is provenance, not runtime evidence."

So it is operator-authored prose, it is explicitly provenance, and it passes through verbatim — three lines after the code deliberately strips three other provenance fields. The module docstring says the projection "removes recorded text, parameter values, selectors, URLs, free-text predicates, and local provenance." For this field that is not true.

Concrete failure: an operator writes risk_explanation: "irreversible — posts to Acme Corp's live billing API for patient 4417". That sentence is then rendered in a public-synthetic export.

I checked the other unnamed fields before claiming a pattern, and they are fine: badges is built from a fixed literal set in visualize/builder.py, and guard_on_unmet and postconditions are controlled vocabularies. risk_explanation is the one free-text field that escapes.

The structural point

The default is backwards. With a deny-list on a deep copy, any field added to GraphNode later ships to public surfaces until someone remembers to null it, and nothing fails when they forget.

openadapt-cloud#336, from this same cluster and the same hour, solves the identical problem the other way: src/lib/runStatePresentation.ts declares a closed FACT_LABELS and types its key as keyof typeof FACT_LABELS, so an unenumerated fact cannot compile. That is the pattern this file should use — build the projected node from named safe fields instead of copying and subtracting.

Minimum to unblock: null risk_explanation for non-local profiles, and add a test asserting no free-text node field survives a public-synthetic projection. The structural rewrite can follow.

Two CI failures, both mechanical

• lint: formatting only, projection.py:86 — the param.model_copy(...) line needs wrapping.
• wheel: check_release_consistency.py reports unregistered=['docs/program-workbench.png']. The new screenshot must be registered in the public artifact inventory and reviewed.

Not merging this. The leak is small to fix but it is a data-boundary defect in an open-core repo, and it should be fixed by someone who owns this boundary rather than patched by me inside your PR.