feat(wiki): add per-wiki glossary API

[hankbobtheresearchoor]

Summary

• add wiki.glossary and wiki.glossary.update for selected registered wikis
• validate fail-closed glossary.yaml policies with canonicalize and strict modes
• expose canonicalization and strict inventory enforcement helpers
• use SHA-256 revisions and optimistic if_match concurrency
• serialize compare-and-replace across threads and gateway processes
• persist with same-directory temporary files, fsync, and atomic replacement
• reject duplicate YAML keys, ambiguous aliases, malformed policies, raw paths, and unknown parameters
• advertise and offload both RPC methods

Contract

Policy remains wiki-local at <wiki-root>/glossary.yaml. Missing files preserve pre-feature behavior. Malformed files fail closed. The RPC accepts configured wiki names only; it never accepts arbitrary filesystem paths.

Verification

• python -m pytest -q tests/tui_gateway/test_wiki_glossary.py tests/tui_gateway/test_wiki.py — 46 passed
• python -m ruff check . — passed
• python -m ruff format --check tui_gateway/wiki_glossary.py tests/tui_gateway/test_wiki_glossary.py — passed
• live read-only RPC probe loaded independent real policies: Research 11 terms, Life 8 terms
• independent review race reproductions are covered by regression tests

Known unrelated CI failures

The full repository matrix is red in unchanged code for:

• tests/tools/test_code_execution.py: terminal stub omits the existing service_code_control schema field
• tests/skills/test_authoring_standards.py: existing llm-wiki-native description exceeds the 60-character hardline
• two tests/test_tui_gateway_server.py assertions still expect only bfl although learning is auto-enabled

The glossary test file, wiki regressions, Ruff gates, Windows footgun gate, Windows tests, e2e, OSV, and supply-chain checks pass.

Companion

Portal companion: ethenotethan/portal#471