Make GraphHub publication revision-safe

[fproulx-boostsecurity]

Summary

• publish GraphHub state using durable Pantry revisions
• fence full-mode clients on committed-state replacement and require snapshot recovery
• send complete projections after every filtered or automatic-mode change
• disconnect saturated clients instead of silently dropping state messages
• make the browser client reject non-contiguous deltas and recover from gaps or fences
• exercise full, filtered, and automatic GraphHub streams in make e2e-smoke

Why

GraphHub previously batched mutation callbacks on a timer and allowed queue overflow to drop messages while keeping clients connected. Snapshot data and version reads were also separate, so a browser could silently continue with a mixed or incomplete graph.

This change consumes the ordered committed Pantry change stream introduced by PR #114. Snapshots now contain one coherent revision, full-mode deltas declare their base and resulting revisions, and any client that cannot remain contiguous must reload a complete snapshot.

Impact

Connected graph clients can no longer continue after missing committed state. Filtered and automatic clients receive revision-coherent projections rather than unsafe full-graph deltas.

An AWS organization scale run analyzed 500 repositories into 11,124 nodes and 11,904 edges. Filtered and automatic publication traffic fell from 12.47 MB to 2.85 MB, approximately 77%, with about 65 ms additional local synchronization latency. Full-mode fence recovery remained sub-second.

Validation

• go test -race ./internal/pantry ./internal/kitchen
• make test
• make lint
• make e2e-smoke
• go test -tags=e2e ./.claude/e2e -run '^$'
• node --check internal/kitchen/browser_assets/graph.js
• real AWS organization Analysis and WebSocket synchronization A/B, without exploitation

The live E2E probes exercised full, filtered, and automatic modes against Kitchen. A visual browser pass remains outstanding because no browser backend was available in the test environment.

Stack

This draft targets modernize/analysis-committed-state and depends on PR #114.

Closes #108