feat(boatstack): make insights reviewable repository artifacts

[bigboateng]

Summary

• Save each confirmed Product Value Map as a tracked docs/insights/<id>/ object with immutable JSON, a human-readable Markdown projection, and append-only events.
• Keep topic association, delivery binding, PR evaluation, duplicate links, and human disposition in repository diffs instead of detached control state.
• Add fingerprint, path, symlink, raw-edit, replay, evaluation, frontier, and human-completion boundaries across generated host adapters.

Boundary conformance

Boundary: a confirmed conversational insight becomes a tracked repository artifact.

Control law: only the exact state-scoped confirmation for the current source hash and preview fingerprint may create the insight object. The write grants neither implementation nor PR-publication authority.

Positive case: confirmed previews atomically create independent reviewable artifacts in embedded and detached supervision modes.

Negative and bypass cases: stale previews, malformed maps, symlink escapes, projection tampering, and raw writes fail closed without partial insight state. Read-only checks and frontier queries do not write.

Relation case: capture, association, criterion binding, delivery PR evidence, and human disposition all append repository-visible evidence; automatic evaluation never completes an insight.

Residual risk: repository disclosure policy remains a human review responsibility. The capture preview warns that exact content enters Git history and may become public.

Conformance status: verified by the full Go and distribution suites.

Verification

• go build ./...
• go vet ./...
• go test ./...
• python3 -m unittest tests.test_product_loop
• Boatstack distribution projection: 391 files matched
• release-note validation and base-aware preflight

Release note

• 2026-08-01-independent-insight-captures.md