fix(WP-0014/A2): close remaining pure-param and structural compilation errors

Convert all remaining `<- paramOrNothing / param / paramOrDefault /
currentUserOrNothing` monadic binds to `let` — these functions are pure
(ImplicitParams-based) in IHP v1.5, so `<-` is a type error in an IO
do-block.

Controllers fixed:
  AgentDelegations, AiGovernancePolicies, Annotations, ApiConsumers,
  CollectiveProposals, DecisionRecords, DeploymentRecords,
  HubCapabilityManifests, HubRoutingRules, InstitutionalKnowledge,
  OutcomeCorrelations, RequirementCandidates, TypeRegistries,
  WebhookSubscriptions, Widgets,
  Api/V2/{Annotations,InteractionEvents,Token}

WebhookSubscriptions: remove orphaned `Right () ->` case arm that was
left inside a bare `unless` block (structural parse error).

Also carries forward all in-progress fixes from the working tree:
  helpers (AgentBridge, ApiRateLimit, BottleneckDetector,
            CrossHubPropagation, FrictionScore),
  views (CanSelect instances, HSX lambda extraction, formFor wrappers),
  env/build (envrc GHCi perms, flake.nix Tailwind + GHC resource limits,
             static/app.css additional Tailwind output).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Web/Controller/RequirementCandidates.hs

@@ -43,7 +43,7 @@ instance Controller RequirementCandidatesController where
     beforeAction = ensureIsUser
 
     action RequirementCandidatesAction = do
-        mStatusFilter <- paramOrNothing @Text "status"
+        let mStatusFilter = paramOrNothing @Text "status"
         candidates <- case mStatusFilter of
             Nothing -> query @RequirementCandidate |> orderByDesc #createdAt |> fetch
             Just s  -> query @RequirementCandidate
@@ -84,8 +84,8 @@ instance Controller RequirementCandidatesController where
     action CreateRequirementCandidateAction = do
         widgets <- query @Widget |> fetch
         threads <- query @AnnotationThread |> fetch
-        mUser   <- currentUserOrNothing
-        let createdBy = fmap (.id) mUser
+        let mUser     = currentUserOrNothing
+            createdBy = fmap (.id) mUser
 
         let candidate = newRecord @RequirementCandidate
         candidate
@@ -136,10 +136,10 @@ instance Controller RequirementCandidatesController where
 
     action UpdateTriageStatusAction { requirementCandidateId } = do
         candidate <- fetch requirementCandidateId
-        newStatus <- param @Text "status"
-        notes     <- paramOrNothing @Text "notes"
-        mUser     <- currentUserOrNothing
-        let changedBy = fmap (.id) mUser
+        let newStatus = param @Text "status"
+            notes     = paramOrNothing @Text "notes"
+            mUser     = currentUserOrNothing
+            changedBy = fmap (.id) mUser
 
         if allowedTransition candidate.status newStatus
             then do
@@ -162,9 +162,9 @@ instance Controller RequirementCandidatesController where
                     redirectTo ShowRequirementCandidateAction { requirementCandidateId }
 
     action AssignReviewerAction { requirementCandidateId } = do
-        userId <- param @(Id User) "userId"
-        mUser  <- currentUserOrNothing
-        let assignedBy = fmap (.id) mUser
+        let userId     = param @(Id User) "userId"
+            mUser      = currentUserOrNothing
+            assignedBy = fmap (.id) mUser
 
         -- Upsert: delete existing assignment then insert
         existing <- query @ReviewerAssignment
@@ -184,7 +184,7 @@ instance Controller RequirementCandidatesController where
         redirectTo ShowRequirementCandidateAction { requirementCandidateId }
 
     action MyQueueAction = do
-        mUser <- currentUserOrNothing
+        let mUser = currentUserOrNothing
         case mUser of
             Nothing -> redirectTo RequirementCandidatesAction
             Just user -> do
@@ -214,8 +214,8 @@ instance Controller RequirementCandidatesController where
         case candidate.requirementId of
             Just rid -> redirectTo ShowRequirementAction { requirementId = rid }
             Nothing -> do
-                mUser <- currentUserOrNothing
-                let createdBy = fmap (.id) mUser
+                let mUser     = currentUserOrNothing
+                    createdBy = fmap (.id) mUser
                 req <- newRecord @Requirement
                     |> set #title candidate.title
                     |> set #description candidate.description
@@ -243,8 +243,8 @@ instance Controller RequirementCandidatesController where
         case existing of
             Just dr -> redirectTo ShowDecisionRecordAction { decisionRecordId = dr.id }
             Nothing -> do
-                mUser <- currentUserOrNothing
-                let decidedBy = fmap (.id) mUser
+                let mUser     = currentUserOrNothing
+                    decidedBy = fmap (.id) mUser
                 -- Use promoted requirement id if available
                 let mReqId = candidate.requirementId
                 dr <- newRecord @DecisionRecord