Add general resource relationships, a session timeline, and blast-radius views

[hellices]

Goal

Generalize korvid's resource relationships into an operational graph, add a
session-scoped change timeline, and use both to explain likely blast radius.

Current gap

korvid already traverses selected owner chains and provides Helm/OLM hierarchy
trees. The relationship model is not yet a general incident surface:

• Services, EndpointSlices, workloads, pods, ingress routes, volumes,
  ConfigMaps/Secrets, PDBs, and nodes are not presented as one navigable graph;
• watch changes and Warning events are not correlated into a session timeline;
• write previews describe the direct target but not the known dependent
  resources that may be affected;
• there is no explicit distinction between declared, observed, inferred, and
  unknown relationships.

Scope

1. Build a typed relationship graph from:
   • ownerReferences;
   • workload selectors and pod labels;
   • Service selectors and EndpointSlices;
   • Ingress/Gateway backends;
   • volume/PVC references;
   • ConfigMap/Secret references without reading Secret values;
   • PDB selectors and node placement.
2. Record a bounded, session-scoped timeline from watch deltas, Kubernetes
   events, context switches, and korvid write outcomes.
3. Add a read-only graph/timeline UI with navigation back to normal resource
   views.
4. Add a deterministic blast-radius summary to destructive write previews using
   known graph edges and explicit uncertainty.

Acceptance criteria

• Every edge has a type, source, confidence class (declared, observed, or
  inferred), and evidence pointer.
• Missing RBAC or unwatched resource kinds produce incomplete-graph indicators;
  absence is not treated as proof that no dependency exists.
• Graph construction avoids per-node API GET fan-out and reuses store/list data.
• Cycles, duplicate selectors, cross-namespace references, and replaced UIDs are
  tested.
• The timeline is bounded by configurable count/size and is cleared or
  partitioned on context switch.
• Blast-radius text names direct and transitive known dependents separately and
  states when the graph is incomplete.
• No Secret value is read or rendered to construct an edge.
• The feature works without an LLM.

Out of scope

• A persistent multi-user historical database.
• Claiming a complete causal dependency graph.
• Blocking a write solely because an inferred edge exists.