Fix Studio reference uploads appearing inactive

[henyjone]

What changed

• allow the existing apsal-media: protocol in Studio's image CSP while keeping direct file: access blocked
• show imported reference thumbnails in project details
• automatically select a newly created reference project and explain the next Codex-analysis step
• publish the Engine-online status after the first renderer RPC starts the sidecar
• claim analysis Jobs explicitly and persist an auditable activity timeline
• show Codex linkage, per-image and synthesis Job state, Schema-validated writes, failures, retries, and completion in Studio
• poll active analysis details every two seconds without treating hidden model reasoning as a public transcript
• document the structured progress contract in the APSAL Skill and interaction guide
• add regression tests for safe media display, startup feedback, Job claiming, and activity events

Root cause

The reference was correctly copied into the private content-addressed APSAL vault and indexed, but the renderer CSP only allowed self and data: image sources. That blocked Studio's own restricted apsal-media: handler, so project covers appeared broken.

After the media fix, analysis.start created Jobs but the UI only displayed aggregate counts. analysis.next did not expose a claimed/in-progress state or durable activity events, so a disconnected Codex task and a genuinely slow task looked identical.

User impact

Imported references are visible immediately. Studio now distinguishes:

• Codex not linked and no Job claimed
• a Headless Codex Job in progress
• per-image analysis written and Schema validated
• synthesis unblocked and claimed
• failure/retry states
• complete visual-DNA analysis

The timeline contains only verifiable protocol events, never hidden chain-of-thought. No private media, result payload, or local path is added to public exports.

Validation

• python3 -m unittest discover -s tests — 89 passed
• npm test -- --run — 5 passed
• npm run test:electron — 3 passed
• npm run build — production build passed
• ARM64 macOS directory package built with Electron 43.1.1
• local visual smoke test confirmed project 111 shows its cover, reference detail, completed two-Job analysis, and six timeline events