feat: refresh Captain’s Bridge records without the first officer

[yia-mw-agent]

Closes #59. Parent: #53. Builds on merged #54, #62, #63. Bumps 0.4.0 to 0.5.0.

What changed

Refresh records in Captain's Bridge rereads the exact bound chat through the app-only read-only tool. It sends no ui/message, starts no background explanation, resumes no project task.

• Record-read time ("Records read") is shown apart from "Explanation prepared from records read". New records set the explanation older without changing conclusions or restamping its preparation time/fingerprint.
• Cited records are revalidated against the chat as it is now; missing evidence fails with "records were not refreshed" and keeps the view.
• Panel: one refresh at a time; responses for a different chat or older than the displayed read are ignored; errors/timeouts/unsupported formats keep the last view, selection and navigation, and report the limitation.
• Reader flags a partially written final record (partialAppend) and the panel says so; it is never shown as a complete or empty successful chat.
• Tests: test_refresh.py (freshness, no restamp, membership, forged citations, read failures, other-chat), test_refresh.cjs (overlap, out-of-order, foreign, error, partial append, retained selection). Added to verify.sh.

Verification

Source: TMPDIR=/tmp scripts/verify.sh passes; mw-version.py check passes.

Installed-host acceptance (NOT run): this worker has no Codex, so direct refresh in the real installed Codex panel under the normal sandbox is not verified. The first officer/Captain owns that check before merge.

[timeleft--]

Reviewed exact head 1b495e53d268f1b8376f867792cd7f6babf35f05 against issue #59. No material findings.

Independent verification: 53 Bridge Python tests, four JavaScript suites, version policy and whitespace checks passed. All six required GitHub checks pass. Installed the exact candidate through the supported Codex marketplace CLI; the maintained host is serving version 0.5.0.

Actual normal-sandbox Codex panel acceptance: opened a clearly labeled synthetic source-backed fixture, selected its work item, returned to the overview, and clicked Refresh. The record-read time advanced from 7:53 PM to 8:00 PM while the explanation source time remained 7:53 PM. The panel explicitly marked the interpretation older than the records, kept its conclusions and highlighted selection, and re-enabled Refresh. The direct app-tool call required no first-officer message. Existing error/race tests cover preservation, partial appends, foreign and out-of-order results.

This approves the source and tested installed-host Refresh behavior; runtime preview publication remains a separate acceptance boundary.