Implement Cockpit Goal Story replay

[smota]

Summary

• Implements Cockpit Goal Story replay as read-only reconstruction, not agent rerun.
• Adds replay schema/derivation, GitHub source adapter, compact timeline grouping, markdown export, UI route, and documentation.
• Completes non-Docker Cockpit UI gaps: branded AgentFlow shell, relationship graph, advanced comment lanes, guarded action forms, CSRF/security headers/rate-limit helpers, optional sanitized runner telemetry endpoint, and QA/security/deployment docs.
• Keeps GitHub data as source of truth; Docker remains deferred.

Issues

Implements #127
Implements #128
Implements #129
Implements #130
Implements #131
Implements #132
Implements #134
Implements #135
Implements #136
Implements #137
Implements #138
Implements #139
Supports #119
Supports #125

Workflow evidence

• Launcher: pi parent
• Executor: pi parent
• Transport: local CLI/tools
• Branch: feature/127-cockpit-goal-story-replay from development
• Delegation boundary: no child implementation delegation in this pass

Validation

• pnpm test — passed, 129 tests / 20 files
• Cockpit smoke: spawned node scripts/cockpit-server.mjs; GET /healthz returned 200 {"ok":true} and CSP header present
• Targeted Prettier — passed for changed replay/cockpit docs and modules

Agent review

• Self-review for implementation pass.
• Security-sensitive remote UI constraints are explicit and tested at helper/API-policy level.
• Human security/acceptance review remains required before public internet exposure.

Follow-ups

• Docker deployment remains second pass.
• Optional future depth: full browser E2E with a live GitHub OAuth test app, persistent multi-instance session backend, richer graph visualization, and signed runner token rotation UI.