feat: host generic Kit observability contributions

[briananderson1222]

Summary

• add an authenticated, tenant-scoped host for the versioned Flow Agents Kit observability contract
• register Builder, Knowledge, and synthetic third-party fixtures through one generic registry with no Kit-ID branches
• preserve contribution revision and lifecycle-at-ingest semantics across historical cohorts
• keep observational and controlled evidence separate while retaining run/source traceability
• quarantine invalid, future-version, cross-tenant, unsafe, and malformed records without stopping valid ingestion
• expose generic workspace and run drill-down APIs with explicit standard-view limitations

Product boundary

Console consumes only the public Flow Agents contract and conformance subpaths. It does not inspect Kit-private artifacts, re-evaluate authority, compute causal lift, or execute MCP Apps. The first slice is deliberately an in-memory standard-view host; durability, UI rendering, and Station parity remain follow-up work.

Stacked dependency

This branch is stacked on the Flow Agents Kit observability contract from kontourai/flow-agents#1122 at exact commit adff692d2aa72bcf8b600b30089b3c8cc6effb76.

Until that package is released, the root development dependency uses an exact HTTPS Git pin and a temporary postinstall step builds the package's public outputs. Before this PR is ready to merge:

1. land and release the Flow Agents contract
2. replace the Git pin with the released semver
3. remove scripts/prepare-stacked-kit-contract.mjs and the temporary root postinstall hook

Verification

• npm ci — pass
• node --import tsx --test console-server/test/kit-observability-host.test.ts — 8/8 pass, including upstream public conformance vectors
• npm --workspace @kontourai/console-server run typecheck — pass
• npm --workspace @kontourai/console-server run build — pass
• npm run check:content-boundary — pass
• node --import tsx scripts/check-lock-integrity.ts — pass
• npm test — pass; Console server 482/482, browser 63 pass with 1 intentional skip, all other suites pass
• pre-push hook repeated the full npm test suite — pass
• Veritas evidence reports promotion_allowed: true, no unresolved files, and clear uncovered-path result; the local readiness process itself hung before a clean exit, so its baseline completion remains NOT_VERIFIED

Not verified / remaining

• durable hosted storage, restart replay, and retention behavior
• responsive, keyboard, and screen-reader Console UI for the contribution workspace
• actual MCP Apps execution (intentionally unavailable in this slice)
• Station parity
• causal treatment-effect computation (intentionally not implemented)
• independent Opus review; both local Claude review attempts stalled without producing a report

Refs #263

[github-actions]

Trust Verify needs attention

Trust Verify completed with result: failure.

Open the workflow run

Failure details

[bundle-required-no-declared-marker] no bundle present and no delivery/DECLARED marker found — bundle-required by default (ADR 0022 §1); publish delivery/trust.bundle, or add a well-formed, in-scope delivery/DECLARED marker

This is advisory and non-blocking; it does not change the Trust Verify verdict or merge requirements.