feat: online verification, node removals, and knowledge browser

Adds claim-bound online evidence records and citation verification scripts,
node removal transport/adapter, retrieval benchmark and owner-review tooling,
GraphCanvas/SourceDetail knowledge browser UI, and the ingest handoff helper.
Bumps the agents/gewu pack to the online-verification branch.

tests/application/test_registry.py

@@ -9,12 +9,48 @@ import pytest
 import yaml
 
 from gewu.adapters.git_repository import GitCanonicalRepository
-from gewu.application.registry import LocalContextProvider, LocalProjectRegistry
-from gewu.domain.contracts import AutoAcceptPolicy, ProjectRecord, ProjectStatus
+from gewu.application.registry import (
+    MAX_CONTEXT_RECORD_BYTES,
+    LocalContextProvider,
+    LocalProjectRegistry,
+    RegistryError,
+)
+from gewu.domain.contracts import AutoAcceptPolicy, ExtractionBlock, ProjectRecord, ProjectStatus
 from gewu.domain.validation import extraction_digest
 from tests.domain.proposal_fixtures import EXTRACTION, NODE, POLICIES, PROJECTS
 
 
+def test_context_loads_large_normalization_maps_with_a_separate_bound(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    text = "a" * 100_000
+    block = ExtractionBlock(
+        block_id="long-block",
+        ordinal=0,
+        original_text=text,
+        normalized_text=text,
+        normalization_map=tuple((index, index + 1) for index in range(len(text))),
+    )
+    candidate = EXTRACTION.model_copy(update={"blocks": (block,)})
+    extraction = candidate.model_copy(update={"extraction_id": extraction_digest(candidate)})
+    raw = extraction.model_dump_json().encode()
+    assert len(raw) > MAX_CONTEXT_RECORD_BYTES
+    repository = GitCanonicalRepository(tmp_path / "knowledge.git")
+    repository.publish_files(
+        expected_head=repository.head(),
+        files={f"extractions/{extraction.extraction_id}.json": raw},
+        message="Publish long normalized extraction",
+        index_directory=tmp_path / "publishing",
+    )
+    provider = LocalContextProvider(repository, tmp_path / "registry.json")
+
+    assert provider().extractions[extraction.extraction_id] == extraction
+
+    monkeypatch.setattr("gewu.application.registry.MAX_CONTEXT_EXTRACTION_BYTES", len(raw) - 1)
+    with pytest.raises(RegistryError, match="Canonical extraction is unavailable or too large"):
+        provider()
+
+
 def test_project_registry_create_and_archive_are_atomic_and_idempotent(tmp_path: Path) -> None:
     registry_file = tmp_path / "control" / "registry.json"
     registry = LocalProjectRegistry(