fix(WP-0014/A2): close remaining pure-param and structural compilation errors

Convert all remaining `<- paramOrNothing / param / paramOrDefault /
currentUserOrNothing` monadic binds to `let` — these functions are pure
(ImplicitParams-based) in IHP v1.5, so `<-` is a type error in an IO
do-block.

Controllers fixed:
  AgentDelegations, AiGovernancePolicies, Annotations, ApiConsumers,
  CollectiveProposals, DecisionRecords, DeploymentRecords,
  HubCapabilityManifests, HubRoutingRules, InstitutionalKnowledge,
  OutcomeCorrelations, RequirementCandidates, TypeRegistries,
  WebhookSubscriptions, Widgets,
  Api/V2/{Annotations,InteractionEvents,Token}

WebhookSubscriptions: remove orphaned `Right () ->` case arm that was
left inside a bare `unless` block (structural parse error).

Also carries forward all in-progress fixes from the working tree:
  helpers (AgentBridge, ApiRateLimit, BottleneckDetector,
            CrossHubPropagation, FrictionScore),
  views (CanSelect instances, HSX lambda extraction, formFor wrappers),
  env/build (envrc GHCi perms, flake.nix Tailwind + GHC resource limits,
             static/app.css additional Tailwind output).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/DecisionRecords.hs

@@ -27,7 +27,7 @@ instance Controller DecisionRecordsController where
     beforeAction = ensureIsUser
 
     action DecisionRecordsAction = do
-        mOutcomeFilter <- paramOrNothing @Text "outcome"
+        let mOutcomeFilter = paramOrNothing @Text "outcome"
         records <- case mOutcomeFilter of
             Nothing -> query @DecisionRecord |> orderByDesc #decidedAt |> fetch
             Just o  -> query @DecisionRecord
@@ -85,8 +85,8 @@ instance Controller DecisionRecordsController where
         requirements <- query @Requirement |> fetch
         candidates   <- query @RequirementCandidate |> fetch
         users        <- query @User |> fetch
-        mUser        <- currentUserOrNothing
-        let decidedBy = fmap (.id) mUser
+        let mUser     = currentUserOrNothing
+            decidedBy = fmap (.id) mUser
 
         let record = newRecord @DecisionRecord
         record
@@ -128,10 +128,10 @@ instance Controller DecisionRecordsController where
                     redirectTo ShowDecisionRecordAction { decisionRecordId }
 
     action AddPolicyReferenceAction { decisionRecordId } = do
-        mUser <- currentUserOrNothing
-        let createdBy = fmap (.id) mUser
-        policyScope    <- param @Text "policyScope"
-        constraintNote <- paramOrNothing @Text "constraintNote"
+        let mUser          = currentUserOrNothing
+            createdBy      = fmap (.id) mUser
+            policyScope    = param @Text "policyScope"
+            constraintNote = paramOrNothing @Text "constraintNote"
         unless (policyScope `elem` validPolicyScopes) do
             setErrorMessage ("Invalid policy scope: " <> policyScope)
             respondWith 422 do
@@ -153,10 +153,10 @@ instance Controller DecisionRecordsController where
         redirectTo ShowDecisionRecordAction { decisionRecordId }
 
     action AddImplementationRefAction { decisionRecordId } = do
-        mUser       <- currentUserOrNothing
-        let linkedBy = fmap (.id) mUser
-        workItemRef <- param @Text "workItemRef"
-        system      <- param @Text "system"
+        let mUser       = currentUserOrNothing
+            linkedBy    = fmap (.id) mUser
+            workItemRef = param @Text "workItemRef"
+            system      = param @Text "system"
         unless (system `elem` validSystems) do
             setErrorMessage ("Invalid system: " <> system)
             respondWith 422 do