fix(admin): console and panel sentences follow the venue a run used (#712) - #722

Part 1 of #712. This fixes all eight "wrong today" items, and builds the worker facts they need.

The worker facts

• serves, a new block per venue in BACKENDS_TABLE: { liveTranscript, steering, recovery, sandboxShell }, each yes, no or image.
  • image means the venue skips the feature by name unless the image declares the capability.
  • A test holds every value to the real code: each bundle's binds and transcript mode, SANDBOX_LAUNCHERS, and every venue's preflight run with and without recover.
• liveSkipped on the run record: the reason a live transcript was skipped. Until now it was only logged.

The eight fixes

1. Sandbox command. The console prints pi-dispatch sandbox <id> only for a venue that has a sandbox shell. Otherwise it gives the panel's own reason.
2. Secrets disclosure. It follows the custody of the trigger's venue. On openshell it says placeholders reach the agent, not values.
3. Live and progress "absent" sentences. They give the record's liveSkipped, or else the venue or image cause.
4. Steer keys. The panel offers them only when the run's inbox is open. Both run views show steerSkipped as a sentence.
5. Setup wizard. An openshell-only deployment is gated on its gateway's engine, then on the openshell CLI and gateway. The wizard offers or refuses the venue by name.
6. Env profiles. PI_SECRET_PROFILES profiles are listed beside the overlay's. Adding a profile refuses, before the confirm:
   • a name the env already declares;
   • a resolver whose real path is outside the roots as written, which is the worker's own rule. A path the panel's host can't resolve gets a note in the confirm instead of a refusal.
7. run.recover with an explicit venue that cannot recover is refused at load and at write. Admin also judges a trigger with no explicit venue against PI_BACKENDS[0].
   • No released triggers.json can hold this pairing, because openshell has never shipped in a release.
8. "Nowhere else" comments. Corrected.

All wording comes from admin tables (STEER_SKIPPED_TEXT, LIVE_SKIPPED_TEXT, SERVES_TEXT, CUSTODY_TEXT) bolted to the worker's enums.

Specs

Amended:

• DES-CONTAINER-BACKEND-REGISTRY, DES-OPERATOR-CONSOLE, DES-ADMIN-VIA-PI-EXTENSION, DES-FIRST-RUN-SETUP-WIZARD, DES-OPENSHELL-VENUE
• INT-RUN-HISTORY-FILE-CONTRACT, INT-TRIGGERS-FILE-CONTRACT
• REQ-OPERATOR-CONSOLE-SCREENS, REQ-DEPLOYMENT-BOOTSTRAP, REQ-RUN-RECOVERY

Residuals

• No default venue from .env: the default venue and the pre-confirm recover check read PI_BACKENDS from the surface's own environment, not the deployment .env (OQ-038, as backendRefusal already does).
• Mixed venue lists: a list such as local,openshell keeps its docker or podman gate in the wizard. up and doctor --openshell cover openshell there.
• Blocking resolve: the resolver realpath is a synchronous call on a UI path, at most one call per root.

Verification

• Review: two adversarial rounds, all findings fixed.
• Full suite with Valkey: only the known macOS mcp failure.
• Build and checks: node admin/build.mjs builds. The revision-row, test-count, temp-dir and dated-fixture checks pass.