Merge Paradigm Centaur upstream through #1126

[fineas-bot]

Summary

Merge Paradigm 22a036b8 into TipLink ad668981 and adopt the upstream implementation through paradigmxyz#1126. The integration is a GitHub-signed two-parent merge commit, so upstream lineage remains explicit.

This adopts upstream workflow-scoped principals, platform-aware session context, Slack strategy/Block Kit dispatch, Console performance and authentication improvements, image handling, Linear fixes, Google Cloud CLI support, workflow analytics dependencies, and security/dependency updates. Conflict resolution starts from the upstream structures and reapplies only active Fineas deployment and security boundaries.

The full reconciliation and rollout contract is documented in docs/UPSTREAM_SYNC_20260719.md.

Sensitive permission audit

• Public Slack threads and explicitly shared Console chats remain readable but owner-only writable. Both composer rendering and POST authorization reject non-owner replies.
• Session context authorization runs before Slack, Discord, Linear, or GitHub metadata is returned.
• Workflow principal JWTs cannot list schedules or emit global workflow events; that remains service-credential-only.
• The upstream workflow-scoped principal model replaces the shared-principal workaround. The dedicated compliance opt-in and grant migration are separate companion PRs.
• Installing gcloud/bq adds no host ADC or generic Google grant. The standard G Suite and privileged compliance Drive credentials remain separate.
• Upstream BigQuery/psycopg additions are reflected in our fork's frozen uv.lock; uv sync --locked passes.
• No database migration is introduced by this upstream range.

Legacy removed or superseded

• Slack execution uses upstream's message-override strategy instead of carrying a parallel flag parser.
• Session platform parsing uses upstream ChatDestination rather than restoring the removed Slack-only helper.
• The Console test helper now uses the shared singleton-method wrapper instead of its duplicate implementation.
• Patch-equivalent upstream behavior is adopted directly; no fork-local alternative was retained for the upstream fixes listed above.

Validation

• cargo fmt --check
• cargo test -p centaur-api-server -p centaur-workflows — 188 passed
• Console: 1,285 tests / 4,886 assertions, 0 failures; 34 schema-dependent skips
• Console security: Brakeman 0 warnings; importmap audit clean; RuboCop 0 offenses; bundler-audit clean
• Slackbot: typecheck; 219 passed / 1 skipped
• Linearbot: 103 passed
• Overlay-independent Python: SDK 24 passed; workflow host 13 passed; Discord 13 passed
• uv sync --project services/workflow-python --locked
• Helm dependency build, overlay compatibility test, lint, and render
• git diff --check and conflict-marker audit

Rollout gate

1. Merge/publish this base change.
2. Merge/publish the companion overlay scoped-principal opt-in.
3. Confirm workflow-compliance-cdd-research is registered.
4. Only then apply the companion infra reconciliation and run a controlled CDD verification.

Do not collapse this sequence into an infra-first rollout.

[fineas-bot]

CI follow-up: the first Rust gate caught clippy::await_holding_lock in the new session-context authorization test. I replaced the test-only std::sync::Mutex with an async-aware tokio::sync::Mutex, then ran the exact cargo fmt --check and cargo clippy --workspace --all-targets -- -D warnings gate successfully. The follow-up is GitHub-verified commit 88a58b62; no production authorization behavior changed.