Complete multi-repository Mindwalk Observatory release candidate

[emart710]

Summary

Completes the integrated Mindwalk Observatory release candidate.

Core observability

• Durable Claude and Codex ingestion
• Restart-safe event streaming and provenance
• Agent and sub-agent projections with truthful unknown states
• Live repository and session UI

Memory and review

• Markdown, JSONL, and SQLite FTS5 memory
• Corrections and tombstones
• Session comparison
• Review Center
• Redacted Markdown exports

Repository discovery

• Bounded metadata-only repository scanning
• Explicit approval before repository registration
• Manual repository onboarding
• Scan cancellation and restart handling
• Symlink, mount, timeout, path, cancellation, and race protections
• Per-root scans
• Accessible keyboard and reduced-motion behavior

Operations and security

• Disabled-by-default integration contracts
• LOW/List rendering mode without WebGL
• Setup, doctor, backup, restore, uninstall, and desktop scripts
• CycloneDX SBOM
• Architecture, privacy, provenance, threat-model, and risk documentation

Validation

• go test -count=1 ./...
• go vet ./...
• make test
• make build
• Production frontend build
• Production Go binary build
• Credential-pattern review
• Generated-asset consistency
• Clean final worktree

Safety notes

Repository discovery is metadata-only and does not inspect repository source or configuration contents.

Discovered repositories require explicit approval before registration.

External integrations remain disabled by default.

No deployment or release publication is included.