fix: make published research visible in Goal results and faithful review cards

[loopx-agent]

Problem and outcome

A published research projection could be read through serve-status, but the ordinary Chat-backed Goal could not discover it. Its existing research renderer therefore remained detached from Files & Outputs. Review cards also reduced a research view to period metrics, losing adjudication, uncertainty and counterevidence when those metrics were absent.

This change connects the existing Goal results tab to the native projection readback and renders the same validated research view in a complete review card. Loading is lazy and Goal-scoped; revision/hash/Origin/public-safe checks remain enforced. Read failures, disabled extensions and Goal changes clear earlier content. Cards preserve exact metric strings, original clocks and review conditions; oversized cards fail rather than truncate the review basis.

Ownership and delivery boundary

Core shares its existing HTTP presentation handler between Chat and status; Finance retains the research semantics and card rendering. No new protocol, model call, account access, scheduler or external message send is introduced. This is a bounded S5/S8/S9 results-consumption slice; deployed App upgrades, actual notification delivery and financial/method utility remain separate acceptance.

Validation

• After integrating current main at f35978e3a, 202 targeted Python tests passed on head f66004a44, covering native HTTP/presentation, Finance cards and Todo settlement/phase-identity recovery. The merge preserves the existing PR commits and DCO sign-offs.
• The current head's packaged Chat build and native-publication browser scenario passed: desktop, 390px mobile, keyboard refresh, Chinese/English, stale/disabled/wrong-Goal/malformed/recovery cases. The original synthetic publication retains its January/February clocks and correctly reads as review_due. Goal directory and corruption cases are scripted; the published projection and HTTP reads are real isolated Core operations. No operational Goal, agent or Todo is created.
• The current head's Core wheel (1.2.4) and Finance wheel (0.8.1) were installed together in a fresh isolated environment. Native publish → HTTP projection → review card preserves the approved synthetic payload and original clocks; Origin/hash/revision failures reject. Installed Chat assets and 1,509 packaged Core / 20 Finance source files match the candidate; a read-only canonical SQLite Todo query also succeeds. This qualifies these candidate packages, without claiming default App installation or a signed update feed.
• The registry I/O manifest is current (278 sites). Earlier candidate validation included 214 related Python tests, desktop build and schema/CSS/Ruff/semantic checks. Those earlier checks retain their original head; current-head validation does not claim all CI or installed native App acceptance.
• Public screenshots are synthetic; private consumer results and raw evidence remain local. No default Core/App replacement or external notification is claimed. The pre-existing locked linkify-it audit advisory remains outside this change; lockfiles are unchanged.

Desktop synthetic results · Mobile synthetic results

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @loopx-agent.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork