feat(P5): IHF Phase 5 complete — agent-assisted distillation

Adds bounded AI support to the IHF governance loop. All AI outputs are
attributed (model_ref), reviewable (AgentReviewRecord), and reversible.
No autonomous decisions; no silent requirement promotion.

- T01: Schema — agent_proposals, agent_review_records,
  confidence_annotations (migration 1743379200)
- T02: AgentProposalsController (index/show/accept/reject, idempotent
  review guard), global nav "Agent" link
- T03: SummarizeClusterAction — Claude API cluster summary on widget show
- T04: DraftRequirementAction — AI requirement draft; acceptance creates
  RequirementCandidate (human-gated)
- T05: DetectDuplicatesAction — duplicate_flag proposal on candidate show
- T06: DetectPolicySensitivityAction — policy_flag with
  ConfidenceAnnotations per concern scope
- T07: ProposeImplementationAction — impl_proposal from decision show
- T08: AgentAuditDashboardAction — autoRefresh; KPI row, unreviewed queue,
  recent proposals, attribution log matrix
- T09: integration tests, SCOPE.md updated, phase5-summary.md, flake.nix
  adds http-conduit/aeson/string-conversions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/View/RequirementCandidates/Show.hs

@@ -28,7 +28,17 @@ instance View ShowView where
             <div class="bg-white rounded-lg border border-gray-200 px-6 py-5">
                 <div class="flex items-start justify-between mb-3">
                     <h1 class="text-2xl font-semibold">{candidate.title}</h1>
-                    <div class="flex gap-2 ml-4">
+                    <div class="flex gap-2 ml-4 flex-wrap">
+                        <form method="POST" action={DetectDuplicatesAction { requirementCandidateId = candidate.id }} class="inline">
+                            <button type="submit" class="text-sm border border-orange-300 text-orange-700 px-3 py-1.5 rounded hover:bg-orange-50">
+                                Check Duplicates
+                            </button>
+                        </form>
+                        <form method="POST" action={DetectPolicySensitivityAction { requirementCandidateId = candidate.id }} class="inline">
+                            <button type="submit" class="text-sm border border-red-300 text-red-700 px-3 py-1.5 rounded hover:bg-red-50">
+                                Policy Check
+                            </button>
+                        </form>
                         <a href={EditRequirementCandidateAction { requirementCandidateId = candidate.id }}
                            class="text-sm border border-gray-300 px-3 py-1.5 rounded hover:bg-gray-50">
                             Edit