feat: make control room glanceable

[wolverin0]

Outcome

• replaces generic Active Work with Waiting on You, Running Now, Queued Next, Programs
• adds operational per-project counts and a loud unclassified strip
• compacts Fleet with status colors and truthful source/rendered counts
• makes Talk to pane 0 primary; collapses Create Work and Delivery log
• opens a persistent, non-modal decision/reply drawer while keeping the desktop dashboard operable
• consolidates bridge and page-refresh health into one status line

Cockpit ownership boundary

The cockpit drawer is intentionally limited to blocker, next_action, operator reply, and approve/retry/cancel. It must not gain diffs, artifacts, dependencies, run history, or agent output. Those rich details remain exclusively owned by the existing /boards task panel, reached through the prominent Open full task action.

The drawer is deliberately non-modal on desktop: opening it reserves dashboard width and must not intercept work elsewhere on the cockpit. The hosted system test opens the drawer first and then operates Create work to guard this design property.

Security gate repair

• separate commit upgrades the Rails stack to 8.1.3.1 for CVE-2026-66066
• bundle audit: no vulnerabilities found against ruby-advisory-db 75149eb

Verification

• targeted: 10 runs, 133 assertions, 0 failures
• RuboCop: 2 files, 0 offenses
• full suite: 2,569 runs; only failure is a pre-existing Zerobitch config-generator expectation, reproduced unchanged on origin/main
• hosted system tests cover both the persistent drawer and opening the existing Boards task panel