feat(fabric): stage configured-source discovery and bounded lookup

[trakhimenok]

Configured project sources can now be inspected on the existing public-data route. Exact Directory identity, immutable provider revision and explicit recordset-to-model mappings supply table/field provenance; unsupported legacy sources show why lookup is unavailable. The technical descriptor remains secondary diagnostics.

The staged consumer verifies pinned canonical metadata with a revision-keyed cache, aggregate 2MiB discovery budget, finite traversal and strict JSON/YAML parsing. Additive browser DALgo execution extracts bounded user keys first, requests only filtered reference pages, retains raw values, and enforces rows, identifiers, bytes, cancellation and deadlines. Exception counts distinguish null, empty, invalid native ROR URLs, unmatched, ambiguous and multiplied results. Existing query storage retains exact source/model/meaning/snapshot/decision/rights pins and requires an explicit run after reopening.

This is preparation for W1 Tasks4/5. Production suggestions and saved public scenarios remain unavailable until reviewed Directory/provider/runtime publication and semantic admission are wired. Schema1 label-bridge fixtures exercise the consumer; format2 native contract ingestion and live native publication remain companion work. The accepted hypothetical ROR fixture at e736203 remains unchanged and is not one of the six demo schemas. Namespace syntax checking does not grant eligibility.

Validation: 86 targeted tests across 10 files, datatug-main lint and Angular library build pass. The actual installed DALgo executes finite keyed fixture pages; tests cover filters, ignored-filter denial, case/space/property/revision/namespace/hash/collision negatives, malformed input without remote lookup, pagination/cancel/deadline/byte limits, parser parity, configured selection→explanation→explicit run→exceptions→save/reopen, changed canonical revision and production unavailable state.

A deliberate browser journey on the owned local Angular preview loaded real configured project metadata and the three pinned canonical indexes (264743 admitted bytes). Expected missing table provenance/publication to disable lookup; observed those messages and disabled Run. No live data-query acceptance is claimed. The full query journey uses bounded fixtures/service doubles. Owned preview and temporary tab are stopped after capture. Local screenshot and browser/check logs are in the independent-review handoff; no machine paths serve as product authority.

WB effort: fabric-w1-apps

Review r1 repairs: require the literal leading zero in ROR tokens (official identifier pattern); actual bounded transport rejects checksum-valid 100000096 as invalid without any target request, while 000000098 is queried and remains unmatched. Primary availability/source copy now precedes collapsed provenance and byte-limit disclosures; selected-field and saved-plan immutable pins remain inspectable. Focused repair tests: 66 across three files, lint/build pass. Actual browser separately verifies collapsed primary and expanded full-pins unavailable states; no live data-query acceptance.

Remaining app implementation (not deployment-only): schema2/native ingestion; fresh exact ROR decision and canonical admission replacing unconditional discovery/saved-execution closure; source-faithful ID/location execution; actual freshness/coverage/confidence/licence explanations and stale last-known-good handling; mutation-to-admitted-suggestion proof; full saved-plan fresh revalidation and acknowledged re-execution through the actual store retaining original snapshot/provenance. Published real configured-field/denominator/orphan/location behavior, runtime keyed filters/pagination/cancel/deadline/byte boundaries, and independent J1–J6 browser network/no-action proof remain acceptance gaps. No unsupported receipt-shape normalization is authorized.