Add local detection insights

[theMobiusStrip]

Summary

• Add a native, read-only Insights window with 24-hour, 7-day, and 30-day views.
• Aggregate retained caution and danger metadata by timeline, finding code and severity, agent, tool, and agent-scoped session.
• Reuse the existing SQLite detection store without schema changes, new telemetry, networking, or LLM calls.
• Expose Insights from both the status menu and the expanded notch panel.
• Add deterministic coverage for query bounds, deduplication, mixed severities, session scoping, DST, and time-zone changes.
• Document the local-only storage and product boundary.

Why

Perch already retains minimal detection metadata locally, but users had no durable way to explore what the endpoint observed after the transient risk cards disappeared. This adds immediate endpoint awareness while preserving Perch's small, offline, read-only identity.

User impact

Users can inspect recent caution and danger trends directly in Perch and clearly see that an observed request does not prove execution, approval, or outcome. Existing monitoring and export behavior remain unchanged.

Validation

• make verify
• make app
• codesign --verify --deep --strict dist/Perch.app
• Bundled app selftest

Generated with Codex.