refactor: SQLite-first cutover for all local read paths (#66)

* fix: exclude dev-only Reins skill from git tracking

.agents/ and skills-lock.json are dev tooling installed via `npx skills add`.
They were being shipped to users via `npx skills add selftune-dev/selftune`,
causing Reins to appear as part of the selftune skill. Now gitignored so
only the intended selftune skill in skill/ is visible to consumers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: remove legacy --alpha-key flag, use device-code flow only

Remove the manual API key provisioning path (--alpha-key flag) from
the CLI. Alpha enrollment now exclusively uses the device-code flow:
browser opens automatically, user approves, credentials are provisioned
and stored without any manual copy-paste.

Also removes zod schemas from telemetry-contract — the cloud repo
(gwangju-v1) already owns its own validation schemas in @selftune/shared.
The OSS CLI only needs types and hand-written validators (zero deps).

- Remove --alpha-key flag from init CLI and InitOptions interface
- Remove direct-key code branch from runInit()
- Update agent-guidance to reference device-code flow
- Update flush.ts error messages
- Update Initialize.md, Doctor.md, SKILL.md, alpha-remote-data-contract.md
- Delete telemetry-contract/src/schemas.ts (zod dependency)
- Remove zod from telemetry-contract package.json
- Rewrite tests to mock device-code flow instead of using alphaKey
- Add SELFTUNE_NO_BROWSER env var to suppress browser open in tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: complete SQLite-first cutover for all local read paths

- Add canonical envelope columns (normalizer_version, capture_mode,
  raw_source_ref) to all 4 SQLite tables with migrations for existing DBs
- Store envelope fields during direct-write inserts so SQLite records
  pass isCanonicalRecord() validation
- Rewrite queryCanonicalRecordsForStaging() to reconstruct full
  contract-compliant records with session-level envelope fallback
- Replace dashboard JSONL file watchers with WAL-based invalidation
- Mark orchestrate signal consumption as SQLite-only (no JSONL rewrite)
- Label remaining JSONL reads as test/custom-path fallbacks only
- Update ARCHITECTURE.md, Dashboard.md, Doctor.md to reflect shipped state
- Prune exec plans: 5 completed, 7 deferred, 4 remain active

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: bump cli version to v0.2.9

* fix: address CodeRabbit review feedback on SQLite cutover PR

- Fix stale-evolution rule using oldest instead of newest audit entry
  (queryEvolutionAudit returns DESC order, so use [0] not [length-1])
- Fix agent guidance emitting placeholder email in next_command
- Add "wal" to runtime-footer type guard in dashboard SPA
- Pass specific listener to unwatchFile() to avoid removing all watchers
- Preserve existing alpha identity metadata on re-auth without flags
- Let alpha mutations bypass existing-config fast path in runInit()
- Replace O(n²) sessions.find() with Map lookup in staging query
- Log failed signal consumed writes in orchestrate
- Fix Dashboard.md SSE section still referencing JSONL watchers
- Remove non-null assertions in staging test
- Convert require() to ESM imports in signal-orchestrate test
- Remove duplicate empty-signals test case

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: resolve lint, formatting, and test assertion failures in CI

- Remove unused readJsonl and queryImprovementSignals imports
- Sort imports alphabetically per biome organizeImports rule
- Format function signatures and long lines per biome formatter
- Use template literal for WAL path concatenation
- Update formatAlphaStatus tests for new guidance without placeholder email
- Remove trailing blank line from duplicate test removal

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* test: add regression test for default SQLite upload-staging path

Writes canonical records directly into SQLite tables (simulating the
runtime hook path), then calls stageCanonicalRecords(db) with default
args to exercise the SQLite read path. Verifies all 4 record kinds
are staged and envelope fields survive the round-trip.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* style: fix biome formatting in queries, observability, orchestrate, staging test

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix CI regressions and follow-up runtime issues

* Add Claude workspace wiring helper

* Harden alpha guidance and init validation

* Fix lint and Claude workspace wiring

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: 3 people