feat(web): repo catalog import, versioning, session notes, memory lifecycle

[danieldear]

Summary

• Repo/catalog skill import: discovery now expands README/index/catalog GitHub links into additional source candidates, enabling bulk select-and-install from a single catalog URL with explicit conflict behavior (keep/replace) and per-card checkboxes; catalog badge and source warnings surfaced in UI
• Artifact versioning: skills, workflows, and personas now carry a patch-incremented version field on each save, exposed in list API responses
• Runtime session notes (Slice D): per-run messages.json artifact, GET/POST /api/runtime/sessions/{id}/messages endpoints, and a Session Notes panel in the run-detail dashboard view
• Memory lifecycle (Slice F): DELETE /api/memory/{scope}/{key} and POST /api/memory/{scope}/purge-expired handlers; delete and purge-expired buttons in the Memory dashboard; ScopedMemoryStore::delete with unit test
• Fuzzy prefix token matching for skill discovery scoring; skill_import_handler syncs Claude slash commands after write
• New docs: docs/github-project-hygiene.md, docs/security-gaps.md

Test plan

• Discover skills with a catalog/README URL and verify expanded results appear with "catalog" badge
• Bulk-select results and install with keep/replace conflict modes
• Save a skill/workflow/persona and confirm version increments on subsequent saves
• Post a session note on a run and verify it persists and displays in Session Notes
• Delete a memory key and purge expired entries from the Memory view
• Run cargo test -p memory and cargo test -p web green

[Copilot]

Pull request overview

This PR expands the web dashboard with catalog-based skill discovery/import, artifact version metadata, runtime session notes, and memory lifecycle controls.

Changes:

• Adds runtime session message APIs/UI and memory delete/purge APIs/UI.
• Extends skill discovery/import with catalog expansion, bulk selection, conflict modes, and slash-command sync.
• Adds version fields for saved skills/workflows/personas plus roadmap/security documentation updates.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
docs/security-gaps.md	Adds security hardening roadmap.
docs/runtime-and-tui-milestone.md	Updates milestone slices for shipped session notes, memory lifecycle, and catalog import.
docs/milestones.md	Updates M4 scope summary.
docs/github-project-hygiene.md	Adds project-board hygiene guidance.
crates/web/src/server.rs	Registers runtime message and memory lifecycle routes.
crates/web/src/api.rs	Implements version helpers, session messages, memory handlers, catalog discovery expansion, and import/save updates.
crates/web/frontend/src/views/SkillsView.vue	Adds catalog warnings, selection, and bulk import UI.
crates/web/frontend/src/views/MemoryView.vue	Adds memory delete and purge controls.
crates/web/frontend/src/views/DashboardView.vue	Adds Session Notes panel for run details.
crates/web/frontend/src/composables/useApi.js	Adds API client methods for messages and memory lifecycle actions.
crates/web/Cargo.toml	Adds uuid dependency for runtime message ids.
crates/sharing/src/lib.rs	Adds bundle export test for skill package directories.
crates/memory/src/store.rs	Adds scoped memory delete support and test coverage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.