Governed dashboard deployment and bulk labels — release candidate

[atx-omni]

Release candidate

Adds scoped Dashboard Migrator plans, destination folder selection, readiness/model-repair handoff, reviewed additive topic/view/relationship diffs, responsive inventory loading, and bulk folder/document labels.

Security and behavior

• Repairs bind approval to source dashboards, workbook extensions, model YAML, destination checksums, and saved-instance boundaries.
• Same-tenant aliases cannot modify selected source models.
• Final transport guards recheck cancellation and write authority after queue/outbound waits. Ambiguous dispatched writes are not automatically retried.
• Bulk labels preserve unrelated labels and require fresh confirmation on changed folder membership.
• Registers all new regression files in the canonical gate; no customer artifacts, local planning documents, vault/job data, credentials or build outputs included.
• Changes include read scheduling/cancellation, persisted deployment plans, and explicitly approved working-branch writes. No tenant changes were performed for this release preparation.

Validation

Passed locally: frontend and Node typechecks; production build and bundle budgets; lint (0 errors, 7 warnings); release-gate structural coverage; targeted label, dispatch-guard, model-binding and topic-service regressions; redacted Gitleaks scan of all 104 changed files (0 findings).

Remaining release gates

Draft for review and CI. Full security:check/browser suite was not run under the current bounded-testing instruction. Live end-to-end acceptance remains outstanding. Full workbook copy remains explicitly capability-blocked; it is not a production-ready fallback. Neither main should be updated automatically.