feat(webui,conversation): S5 WebUI views and CHAT-03 follow-ups (row 40, #1522)

Dewey's round 3 candidate, manifest
agents/dewey/work/queue-40/candidate-manifest-r3.sha256 (d0aa0ded,
27 files, checked OK in the canonical tree).

- WebUI inbox, tasks, agents and trail views, read-only over /api/bus.
  The README says the bus proof ends at the Console process.
- CHAT-03 seal: the engine command is fixed, the engine environment is
  explicit, SEAL_FLAGS has --no-approve, escalating is cleared on throw.
- Terminal input typed after Ctrl-T or Ctrl-O is held. Only the run whose
  own parse set held drains it (T1), and #run catches errors per action.
- DEFERRED keeps N2 and moves F2 to done, citing T1.

Reviews: Filbert approve (comment 27011, rev 260), Darkwing approve
(27013, rev 264). Landing gate on 8cad7722 plus the candidate: webui 22,
conversation 161, control-board 124, every scripts/test-*.sh green,
test-task 98/0. Mutant Mr survives; its flows test is the first
follow-up row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/DEFERRED.md

@@ -187,24 +187,21 @@ at every gate. Started 2026-09-12 during the control board MVP.
   (2026-10-04)
 - **CHAT-03 I1 round 2 follow-ups, for the I3 brief.** Neither reviewer
   held any of these as blocking (Darkwing comment 26690, Filbert comment
-  26694 on #1507).
-  - The engine command and `preArgs` sit outside the seal. They're
-    documented as a test hook, but `preArgs` with the default command
-    reaches real Pi unsealed. The I3 entry point must not take them from
-    config. Both reviewers found this.
-  - `engine.env` defaults to `process.env`. I3 builds the engine's
-    environment from an explicit list. Darkwing F3.
-  - `escalating` is set in `controller.mjs` before `after()` runs. If
-    admission or poison throws, the flag stays set, and later force stops
-    are refused as `fenced` until restart. Darkwing F2.
+  26694 on #1507). Four of the five are closed by slice 1 S5 (see Done);
+  this one stays open.
   - No test proves that the processes are listed only after the cgroup
     is frozen. The code waits for `frozen 1` in `cgroup.events`, and
     both Filbert and Dewey confirmed it by reading it. Mutants r2-B5b and
     C4 survive. Proposed: a test-only hold after `members`, or a FUSE or
     privileged fixture. Filbert F1.
-  - A takeover followed by Enter in the same chunk leaves the text
-    unsent. Filbert F2.
   (2026-10-04, #1507)
+- **CHAT-03 `engine.envKeys` accepts founder credential names.**
+  `CREDENTIAL_NAME` in `packages/conversation/src/pi-pin.mjs` matches any
+  `*_API_KEY` or `*_TOKEN`, including `GITEA_TOKEN` and `GH_TOKEN`, which
+  the S6 runner refuses as founder credentials (REQ-CRED-2). Nothing
+  builds a Controller outside the tests yet. Whoever wires the entry point
+  narrows the pattern to provider names or checks the founder list.
+  Filbert N2 on #1522. (2026-10-10)
 - **`test-task.sh` makes a live Pi call without the Docker guard.** The
   "user recall" block near line 478 runs `run-task.sh` with no
   availability check, so a run with Docker unavailable fails "user recall
@@ -264,3 +261,23 @@ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
     shared clones and 10 exports, one after another. All 20 passed
     148/148 (2960 of 2960). The 300 ms deadline test is unchanged. Counts:
     `agents/filbert/work/queue-33/cold-runs.txt`.
+- CHAT-03 I1 round 2 follow-ups (2026-10-04, #1507): four of five closed
+  by slice 1 S5 (row 40, #1522; Dewey authored, Darkwing and Filbert
+  reviewing). The commit is named in the row's review record when it
+  lands.
+  - Engine command and `preArgs`: `engine` takes only `extraArgs`, `cwd`
+    and `envKeys`. The controller always launches the pinned Pi and
+    checks that at construction and at bind. The fake engine comes in
+    through a symbol key that JSON config can't carry (N24b).
+  - Engine environment: an explicit list (`ENGINE_ENV` in `pi-pin.mjs`)
+    plus `*_API_KEY` and `*_TOKEN` names from `engine.envKeys`. Nothing
+    else is inherited. `HOME` passes, so Pi reads `~/.pi/agent` unless
+    `PI_CODING_AGENT_DIR` is set (Darkwing F3).
+  - `escalating` is cleared when the force-stop fence throws (Darkwing F2,
+    races.test.mjs).
+  - Takeover then Enter in one chunk: input after Ctrl-T or Ctrl-O waits
+    for that action, in the same chunk or a later one, and also while an
+    earlier action is still pending, so it is judged as if typed one key
+    at a time (Filbert F2; Darkwing and Filbert T1 on #1522;
+    flows.test.mjs).
+  The frozen-cgroup test (Filbert F1) stays open above.