Add sourceosctl explain and evidence topology views

[mdheller]

Purpose

Implement the operator-facing explanation surface for SourceOS Mutation and Evidence Accountability, anchored to SourceOS spec PR #96:

SourceOS-Linux/sourceos-spec#96

Required commands

• sourceosctl explain writes
• sourceosctl explain sync
• sourceosctl explain browser
• sourceosctl explain terminal
• sourceosctl explain logs
• sourceosctl explain compromise

Required UI concepts

• Evidence Topology panel: event sources, sinks, routing, privilege requirements, redaction, sampling, drops, retention.
• Mutation Graph view: human intent, actor chain, object/path class, operation, policy, resource cost, causal parents, evidence quality, and downstream effects.

Acceptance criteria

• Operator can distinguish no positive compromise evidence from evidence sufficient to clear compromise.
• Resource incidents show delegated actors and missing evidence fields.
• UI/CLI can render at least one validated fixture from PR #96.

[mdheller]

Status (2026-07-18): The explain command surface (sourceosctl explain writes/sync/browser/terminal/logs/compromise) and the Evidence Topology panel and Mutation Graph view are not implemented in sourceos-shell. The sourceosctl explain sub-commands live primarily in sourceos-devtools (PR #49, manifest-scanner-m1). The shell-side UI/CLI for evidence topology views and compromise-clearance distinction remains future work. Keeping open.

[mdheller]

Implemented in PR #30 (feat/shell-ergonomics-stubs, now merged into main).

Issue #15 is addressed by:

• scripts/sourceosctl: operator CLI with explain surfaces, state-integrity status, lifecycle status
• schemas/host-runtime-lifecycle.schema.json: typed JSON Schema 2020-12 for all 13 lifecycle states
• docs/adr-035-examples.md: EngineManifest + BoundaryTransition + FaultEnvelope fixtures for shell-adjacent engines

All commands verified working (lifecycle status, state-integrity status --json, all explain surfaces).