feat(transparency): decision explainer + doberman tui (ADR 0029)

[fu351]

Slice

• Feature / Slice: DT.1 — Decision Transparency: explain helper + doberman tui
• Plan reference: ADR 0029 (decision transparency + monitor floor)

What this PR does

Turns any redacted decision-log row into a plain-language "why", and adds a Textual TUI to browse the log with an explanation panel.

• doberman.explain — template_explanation() (deterministic, offline, always available) + an opt-in Claude-Haiku narrator gated on all three of: anthropic importable, ANTHROPIC_API_KEY, DOBERMAN_EXPLAIN_LLM truthy. use_llm can only restrict (a caller can force the template but can never bypass the env opt-in). The LLM sees only an allowlist projection (REDACTED_FIELDS) of the already-redacted row — narrator, never judge. Any failure falls back to the template; the module never raises.
• doberman tui — Textual decision browser (q quit / r reload). Row-derived strings render markup-inert (rich.text.Text cells, markup=False panel) so a crafted stored value can't restyle/spoof the browser. LLM enrichment runs in a debounced, cached thread worker with a stale-selection guard, so a slow narrator call never freezes the UI or overwrites a newer row. Lazily imported behind an importlib guard: without the tui extra the command prints an install hint and exits 1, and core stays fully standalone.
• policy/checklist.py — enforcement docstring corrected to the Option A monitor-floor semantics (the objective floor stays live in every enforcement state).
• pyproject.toml — 0.13.0; new extras tui=[textual], explain=[anthropic]; textual added to dev so CI actually exercises the TUI tests (anthropic deliberately NOT in dev — tests fake the SDK).

Tests added (run in CI)

• tests/unit/test_explain.py (26) — template wording per verdict, malformed reason codes never raise, pinned REDACTED_FIELDS allowlist (the constant can't bless itself), payload projection, full opt-in gate matrix incl. non-truthy flag values and use_llm restrict-only semantics, request-egress check that a stray secret on the row never reaches the (fake) SDK, keyword-strict fake messages.create mirroring the real surface, LLM failure/blank fallback, and the doberman tui no-textual CLI guard (kept here so it runs in the standalone venv).
• tests/unit/test_tui.py (6, importorskip("textual")) — pilot tests: seeded rows + explanation shown, empty-repo placeholder, q quits, a synthetic secret in the raw target is never visible in any cell or the panel (end-to-end through storage redaction), crafted Rich markup renders literally, r reloads newly recorded decisions.

Public-release safety

• Contains nothing from the "not allowed" list: no enterprise/hosted code, no proprietary detection, no customer data, no secrets, no commercial-license code
• Core still builds/tests/runs with NO enterprise package installed (and with neither optional extra installed)

Security checklist

• Fails closed on error / uncertainty (LLM path falls back to the template; TUI never crashes on a narrator failure)
• No secret, full file, or unredacted prompt logged or committed (allowlist projection + synthetic-secret egress/visibility tests)
• Any guardrail/learning change is raise-only (no decision-path change at all — explain/tui are read-only over the redacted log)
• Every BLOCK/AUTH carries reason codes + a human explanation (this PR adds the plain-language layer on top)

Edge cases covered / Deviations from plan / Risks introduced

• Malformed/tampered rows (bad JSON, non-string reason codes, missing keys, Rich markup) render safely, never crash.
• use_llm=True cannot bypass the env opt-in; non-truthy flag values ("0", "false", "no", "off", "", " ") stay off.
• Per user decision: no doberman explain command — the TUI is the rich surface, doberman log the plain fallback.
• Risk: LLM narration quality is unverified against a live API (opt-in only; deterministic template is the contract).