fix(*): show exec diffs on the page and fix three confirmation details

[arelchan]

Summary

Four follow-ups from a sandbox acceptance run of main on the web page, driven through raven web (the gateway) the way users open it.

• exec diffs on the page. A file an exec command wrote opened as the file, not as a diff, when its row in the desk's diff tab was pressed. The gateway built its loop with interactive=False, and that flag only gates the per-turn checkpoint, so no gateway turn (page, chat apps, cron) had a shadow repo. exec measures a command's writes against that repo (fix(*): let exec measure the files its command wrote #829); without one a created file goes out with counts only and a rewrite as a bare row, and the desk opens a row with no hunk as the file. Both gateway TurnPolicy sites (first generation and reload) are now interactive=True, which is what the CheckpointConfig docstring already says the gateway is. Links in the reply text still open the file; only the diff tab's rows open the diff.
• The card for connecting an agent. An add was laid out as a change to the subagents setting: the whole table as the old value, the call's JSON as the new one, and no security note when it lent a key. change_view now gives an add its own agents list (name, preset, model, lend_key) plus the subagents.*.lendKeys note when a key is lent; the tool adds each preset's display name (Pi, not pi). The page draws one line per agent ("Connect Pi, started with Raven's openrouter key") and the note. The prompt line also stops saying a lent first run spends the agent's own quota, since the lent key pays for it.
• The credential card's keys. It was written before the approval sheets moved to key caps (feat(ui): preview files by what renders and answer approvals with cmd+enter #817) and kept numbered rows answered by 1 and 2. It now uses the sheets' foot: Esc skips, the send chord saves, skip first and save last, no digits. The foot is one shared SheetActs in AskApproveSheet.tsx, which keeps the import-direction gate clean.
• Connectors subtitle. feat(ui-web): move channels out of settings and beside agents under one rail row #830 replaced the agents page title with the module tabs and dropped its one-line description. HubHead now shows a line for the module on screen: the original agents line, and a matching new one for channels (en and zh).

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

• uv run --frozen --all-extras pytest -q -n 8 with coverage: 27446 passed, 27 failed. 22 of the failures fail the same way on clean main on this machine (research tool vendors, libreoffice, simulation timing). The other 4 were test_cli_agent_loop_parity, fixed by keeping both gateway TurnPolicy calls inline; it now passes with tests/test_cli_gateway_commands.py (95 passed).

• scripts/coverage_gate.py diff --base-ref github/main --threshold 90: 91.67%. The two uncovered lines are the two interactive=True arguments, which a source test pins. ratchet and baseline-check pass.

• Mutation checks, each reverted fix making a test fail: either gateway site back to False; the add card's agents, its lend note, the lent-run prompt line and the display name; the page's add row and its words; the credential card's chord save, its key caps, and digit answers restored.

• npm test in ui-web: 214 files, 3175 tests passed. npm run lint (0 errors, the 4 existing warnings), npm run type-check, npm run gen:check, check-class-namespace, check-css, npm run lint:i18n --prefix ui-tui.

• ruff check, ruff format --check, lint-imports (10 kept), check_source_language.py github/main..HEAD, commitlint.

• Boot snapshots regenerated: each gains the p.hub-head-sub line and nothing else (the live one against a closed port).

• Manual, in a sandbox RAVEN_HOME through raven web --foreground: an exec that created fresh.txt and appended to notes.md listed both with counts, and each diff-tab row opened the diff while the reply's link opened the file; the Tavily key card showed Esc / Cmd+Enter caps and saved on Cmd+Enter; "connect Pi with Raven's openrouter key" showed the one-line card with the lend note; both hub tabs showed their line.

• Relevant tests pass locally

• Relevant lint / type checks pass locally

• User-facing docs or screenshots are updated when needed: no docs cover these surfaces, and the repo keeps no image assets.

Risk

User-visible changes:

• Gateway sessions now get the per-turn shadow-git checkpoint the CLI and raven serve already had: a commit of the working directory at the end of each turn (skipped for a home directory and its ancestors, and off with runtime.checkpoint.policy = "never"), and a recovery note after an interrupted turn.
• The connect-agent confirmation and the credential card look different; the credential card no longer answers 1 or 2.

Rollback is reverting the squash commit. Setting runtime.checkpoint.policy to never turns the gateway checkpoint off without a revert.

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

Related Issues

N/A

[gloryfromca]

No blockers; this can merge as far as I am concerned.

I reviewed the full github/main...HEAD diff and traced the changed producers and consumers: gateway TurnPolicy construction through checkpoint activation and exec diff measurement, config add evidence through the approval card, credential key handling and shared sheet controls, and both hub-page render paths. I also checked the relevant history and project constraints in AGENTS.md, CONTEXT-MAP.md, CONTEXT.md, and ui-web/CONTEXT.md; backward compatibility; generated i18n/RPC state; and that tests were extended rather than weakened.

Verification: uv run --all-extras pytest tests/test_cli_gateway_commands.py tests/test_raven_config_tool.py tests/test_config_self_surface.py -q (320 passed); focused Vitest for HubHead, approval, and credential behavior (64 passed); npm run type-check; npm run gen:check; focused Ruff and format checks; source-language check; and npm run lint (0 errors, four pre-existing warnings on untouched lines). An initial Python invocation without --all-extras reached no test bodies because the autouse fixture could not import optional raven_everos; the all-extras rerun above is the valid result.