Restore standalone source navigation

[forhappy]

What changed

• restore working forge links for local-only graph commits when a published common ancestor contains byte-identical content for every source path represented by the graph
• retain the fail-closed behavior when any represented source file differs, a path is unsafe, or validation exceeds bounded limits
• show an accessible standalone-viewer notice instead of silently ignoring source actions when no safe remote target exists
• regenerate the shared viewer assets and update CLI help, output reference documentation, and the changelog

Root cause

The previous dead-link fix removed source-navigation metadata whenever the graph commit was not reachable from an origin tracking ref. The viewer still rendered enabled source actions, so clicks dispatched an unhandled browser event and stopped. In bbolt, the local commits only changed unrelated metadata; the source files were identical to published origin/main, but Compass did not prove or use that safe fallback.

User impact

For the reported bbolt export, Compass now selects published revision 21b0572d2e641f7bef77fa259e7aaa9c1653e0c9, producing a valid immutable compact.go#L1-L120 link. Genuinely unpublished source changes remain local-only and direct users to the VS Code extension.

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --lib --bins --locked -- -D warnings
• cargo test --workspace --lib --bins --locked
• cargo test -p compass-cli --test viewer_export_cli --locked
• cargo test -p compass-cli --test compass_product --locked
• npm run typecheck:js
• npm run test:js (324 unit tests and 83 browser tests)
• node scripts/check_viewer_assets.mjs
• sh scripts/check_product_boundary.sh
• ./scripts/qualify_code_graph_v1.sh --fixtures-only
• direct replay against /Volumes/Workspace/Github/bbolt/compass-out/graph.json