feat: separate local operator plane

[jeffscottward]

Summary

• move development orchestration into a separate local operator application
• add durable queued workflow and Wayfinder planning boundaries
• harden the macOS OMP sandbox, trusted Git execution, tracker publication, and bounded model behavior
• keep the deployable product application operator-free
• align request-local dashboard loading with the bounded database runtime

Verification

• bun run verify:core
• bun run coverage:update (100% statements, branches, functions, and lines)
• bun run graph:update
• bun run graph:check
• bun run graph:verify
• deterministic 3,001 ms dashboard regression passed 20 consecutive runs
• all 48 dashboard loader, transport, and internal-dispatch tests pass
• the full six-spec browser suite passed twice with complete teardown
• independent code review approved the dashboard repair
• all 14 configured checks pass for 15e0417

Dashboard CI repair

The original failed browser attempt safely classified the defect as a request-local SSR dashboard availability failure: the page rendered its generic error state, then a separate direct oRPC request returned HTTP 200 after the five-second heading wait. The loader did not retain the exact original non-authorization subtype. The identified policy mismatch was deterministic: internal oRPC dispatch inherited a 3-second transport deadline while the request database permits a bounded 10-second connection and query interval. Only request-local dashboard dispatch now uses the 10-second deadline. The shared transport default remains 3 seconds. A delayed 3,001 ms response failed before the repair and passes after it. Both replacement browser CI jobs pass.

Known local blocker

One clean-head browser-queued Wayfinder run reached sandboxed OMP but timed out after 300,039 ms before publishing map.md. An equivalent unsandboxed 4B model profile completed in 86,499 ms and wrote a valid map. The cause is unproven across LM Studio, sandbox policy, OMP integration, or their interaction. .omp-status.md records the owner, evidence, rerun trigger, and stop condition. No successful browser tracker publication is claimed.