fix(WP-0014/A2): close remaining pure-param and structural compilation errors

Convert all remaining `<- paramOrNothing / param / paramOrDefault /
currentUserOrNothing` monadic binds to `let` — these functions are pure
(ImplicitParams-based) in IHP v1.5, so `<-` is a type error in an IO
do-block.

Controllers fixed:
  AgentDelegations, AiGovernancePolicies, Annotations, ApiConsumers,
  CollectiveProposals, DecisionRecords, DeploymentRecords,
  HubCapabilityManifests, HubRoutingRules, InstitutionalKnowledge,
  OutcomeCorrelations, RequirementCandidates, TypeRegistries,
  WebhookSubscriptions, Widgets,
  Api/V2/{Annotations,InteractionEvents,Token}

WebhookSubscriptions: remove orphaned `Right () ->` case arm that was
left inside a bare `unless` block (structural parse error).

Also carries forward all in-progress fixes from the working tree:
  helpers (AgentBridge, ApiRateLimit, BottleneckDetector,
            CrossHubPropagation, FrictionScore),
  views (CanSelect instances, HSX lambda extraction, formFor wrappers),
  env/build (envrc GHCi perms, flake.nix Tailwind + GHC resource limits,
             static/app.css additional Tailwind output).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/DeploymentRecords.hs

@@ -62,7 +62,7 @@ instance Controller DeploymentRecordsController where
         decisions <- query @DecisionRecord |> fetch
         implRefs  <- query @ImplementationChangeReference |> fetch
         users     <- query @User |> fetch
-        mDecisionId <- paramOrNothing @(Id DecisionRecord) "decisionId"
+        let mDecisionId = paramOrNothing @(Id DecisionRecord) "decisionId"
         let record = newRecord @DeploymentRecord
         render NewView { record, decisions, implRefs, users, mDecisionId }
 
@@ -70,8 +70,8 @@ instance Controller DeploymentRecordsController where
         decisions <- query @DecisionRecord |> fetch
         implRefs  <- query @ImplementationChangeReference |> fetch
         users     <- query @User |> fetch
-        mUser     <- currentUserOrNothing
-        let deployedBy = fmap (.id) mUser
+        let mUser      = currentUserOrNothing
+            deployedBy = fmap (.id) mUser
 
         let record = newRecord @DeploymentRecord
         record
@@ -86,9 +86,9 @@ instance Controller DeploymentRecordsController where
                     redirectTo ShowDeploymentRecordAction { deploymentRecordId = created.id }
 
     action RecordOutcomeSignalAction { deploymentRecordId } = do
-        signalType <- param @Text "signalType"
-        mValue     <- paramOrNothing @Double "value"
-        mUser      <- currentUserOrNothing
+        let signalType = param @Text "signalType"
+            mValue     = paramOrNothing @Double "value"
+            mUser      = currentUserOrNothing
         let validTypes = ["improved", "regressed", "neutral", "inconclusive"] :: [Text]
         unless (signalType `elem` validTypes) do
             setErrorMessage ("Invalid signal type: " <> signalType)
@@ -123,10 +123,10 @@ instance Controller DeploymentRecordsController where
                 setErrorMessage "Already evaluated — one evaluation per deployment."
                 redirectTo ShowDeploymentRecordAction { deploymentRecordId }
             Nothing -> do
-                mUser <- currentUserOrNothing
-                let evaluatedBy = fmap (.id) mUser
-                scoreText <- param @Text "score"
-                rationale <- param @Text "rationale"
+                let mUser       = currentUserOrNothing
+                    evaluatedBy = fmap (.id) mUser
+                    scoreText   = param @Text "score"
+                    rationale   = param @Text "rationale"
                 let mScore = readMaybe (cs scoreText) :: Maybe Int
                 case mScore of
                     Nothing -> do