Validation framework 413 (#443)

* feat(middleware): add Quickwit haystack integration with hybrid index discovery

Implements Phase 3 (Steps 1-10) of disciplined development plan for Quickwit
search engine integration. Adds comprehensive log and observability data search
capabilities to Terraphim AI.

Core Implementation:
- ServiceType::Quickwit enum variant for configuration
- QuickwitHaystackIndexer implementing IndexMiddleware trait
- Hybrid index selection (explicit configuration or auto-discovery)
- Dual authentication support (Bearer token and Basic Auth)
- Glob pattern filtering for auto-discovered indexes
- HTTP request construction with query parameters
- JSON response parsing with graceful error handling
- Document transformation from Quickwit hits to Terraphim Documents
- Sequential multi-index search with result merging

Technical Details:
- Follows QueryRsHaystackIndexer pattern for consistency
- 10-second HTTP timeout with graceful degradation
- Token redaction in logs (security)
- Empty Index return on errors (no crashes)
- 15 unit tests covering config parsing, filtering, auth
- Compatible with Quickwit 0.7+ REST API

Configuration from try_search reference:
- Production: https://logs.terraphim.cloud/api/
- Authentication: Basic Auth (cloudflare/password)
- Indexes: workers-logs, cadro-service-layer

Design Documents:
- .docs/research-quickwit-haystack-integration.md (Phase 1)
- .docs/design-quickwit-haystack-integration.md (Phase 2)
- .docs/quickwit-autodiscovery-tradeoffs.md (trade-off analysis)

Next: Integration tests, agent E2E tests, example configs, documentation

Co-Authored-By: Terraphim AI <noreply@terraphim.ai>

* docs: add validation framework research and plan approvals

* Add Tauri signing setup and improved build scripts

- Add comprehensive Tauri signing setup script with 1Password integration
- Add temporary key generation for testing
- Update build-all-formats.sh to use Tauri signing configuration
- Add detailed setup instructions and security notes
- Support both 1Password integration and manual key setup

This enables proper code signing for Terraphim desktop packages
while maintaining security best practices with 1Password integration.

* feat(validation): add validation framework and performance benchmarks

* Update Cargo.lock and build artifacts after merge

* Clean up merge artifacts and broken tests

* chore(validation): remove backup test files

* fix(packaging): complete build-all-formats.sh with all format scripts

- Fix duplicate regex dependency in terraphim_automata/Cargo.toml
- Add individual build scripts for deb, rpm, arch, appimage, flatpak, snap
- Fix scope bug in build-all-formats.sh where format variable was out of scope
- Add proper artifact collection from multiple directories
- Add build result tracking and summary reporting
- Make scripts cross-platform compatible

Co-Authored-By: Terraphim AI <noreply@anthropic.com>

* chore(deps): update Cargo.lock

* test(validation): restore integration tests behind feature flags

* docs: add validation framework reports and documentation

- Add runtime-validation-hooks.md
- Add validation-report-validation-framework.md
- Add verification-report-validation-framework.md
- Add vmodel-final-report-validation-framework.md
- Update README with validation framework info
- Fix quickwit.rs borrow pattern

* fix: update Document constructors for new API

Update terraphim_validation test fixtures to include new Document fields:
- doc_type
- synonyms
- route
- priority

Fixes compilation errors after rebase onto main.

* ci: add workspace permission fix for self-hosted runners

Add 'Fix workspace permissions' step to all CI jobs running on self-hosted
runners. This prevents EACCES permission errors when the checkout action
tries to clean files created by Docker containers with different ownership.

The fix runs before Pre-checkout cleanup and ensures the runner user
owns all files in the workspace.

Fixes consistent permission issues on terraphim-ai self-hosted runners.

* ci: add disk cleanup step to prevent disk full errors

Add 'Disk cleanup' step to all Rust jobs that runs after checkout but
before Rust toolchain installation. Cleans up:
- ~/.rustup/tmp/* (temp files from previous installs)
- ~/.cargo/registry/cache/* (cached crate downloads)
- ~/.cargo/git/checkouts/* (git dependencies)
- Docker system prune (unused containers/images)

Also shows df -h output for debugging disk usage.

This prevents 'No space left on device' errors during Rust toolchain
installation on self-hosted runners.

* fix(spawner): remove needless borrow in spawn_process call

* fix: resolve clippy warnings across workspace

Fix multiple clippy errors preventing CI from passing:

- terraphim_spawner: Remove needless borrow in spawn_process call
- terraphim_middleware: Replace or_else/unwrap_or_else with or/unwrap_or
- terraphim_orchestrator: Remove .clone() from Copy type (ProcessId)
- terraphim_tinyclaw: Use std::hint::black_box instead of deprecated criterion::black_box
- terraphim_github_runner_server: Use slice indexing instead of deprecated as_slice()
- terraphim_validation: Remove unnecessary borrow in try_parse_from
- terraphim_agent: Add repl-web-advanced feature and allow unused imports in test

All changes are non-functional refactoring to satisfy clippy -D warnings.

* ci: add cargo clean before clippy to ensure fresh build

* ci: add verbose clippy error output for debugging

* ci: simplify clippy step and add RUST_BACKTRACE (trigger rebuild)

* fix(server): restore get_role_extra helper functions with proper doc comments

* fix(server): remove duplicate helper functions, use inline logic

* fix(server): fix doc_lazy_continuation clippy warnings

Add blank lines after first lines of doc comments to fix clippy
warnings about lazy continuation:
- Add blank line after '4. Hardcoded fallback (lowest priority)'
- Add blank line after 'Get a string value from Role.extra...'
- Add doc comment for resolve_llm_config function

Part of: #443

---------

Co-authored-by: Terraphim CI <alex@terraphim.ai>
Co-authored-by: Terraphim AI <noreply@terraphim.ai>
Co-authored-by: Terraphim AI <noreply@anthropic.com>

Author: 4 people

.docs/constraints-analysis.md

@@ -0,0 +1,257 @@
+# Terraphim AI Release Constraints Analysis
+
+## Business Constraints
+
+### Release Frequency and Cadence
+- **Continuous Delivery Pressure**: Community expects regular updates with bug fixes
+- **Feature Release Timeline**: New features need predictable release windows
+- **Patch Release Speed**: Security fixes must be deployed rapidly
+- **Backward Compatibility**: Must maintain API stability between major versions
+- **Version Bumping Strategy**: Semantic versioning with clear breaking change policies
+
+### Community and User Expectations
+- **Zero-Downtime Updates**: Production deployments should not require service interruption
+- **Rollback Capability**: Users need ability to revert problematic updates
+- **Multi-Version Support**: Ability to run multiple versions concurrently for testing
+- **Documentation同步**: Release notes must match actual changes
+- **Transparent Roadmap**: Clear communication about future changes and deprecations
+
+### License and Compliance Requirements
+- **Open Source Compliance**: All licenses must be properly declared
+- **Third-Party Dependencies**: SPDX compliance and vulnerability disclosure
+- **Export Controls**: No restricted cryptographic components without compliance
+- **Data Privacy**: GDPR and privacy law compliance for user data handling
+- **Attribution Requirements**: Proper credit for open source dependencies
+
+## Technical Constraints
+
+### Multi-Platform Build Complexity
+
+#### Architecture Support Matrix
+| Architecture | Build Tool | Cross-Compilation | Testing Capability |
+|--------------|------------|-------------------|--------------------|
+| x86_64-linux | Native | Not needed | Full CI/CD |
+| aarch64-linux | Cross | QEMU required | Limited testing |
+| armv7-linux | Cross | QEMU required | Limited testing |
+| x86_64-macos | Native (self-hosted) | Not needed | Partial testing |
+| aarch64-macos | Native (self-hosted) | Not needed | Partial testing |
+| x86_64-windows | Native | Not needed | Full CI/CD |
+
+#### Toolchain Dependencies
+- **Rust Version**: Consistent toolchain across all platforms
+- **Cross-Compilation Tools**: QEMU, binutils for non-native builds
+- **System Libraries**: Platform-specific dependency management
+- **Certificate Signing**: Platform-specific code signing certificates
+- **Package Building**: cargo-deb, cargo-rpm, Tauri bundler tools
+
+### Dependency Management Constraints
+
+#### System-Level Dependencies
+```toml
+# Example dependency constraints
+[dependencies]
+# Core dependencies with version ranges
+tokio = { version = "1.0", features = ["full"] }
+serde = { version = "1.0", features = ["derive"] }
+clap = { version = "4.0", features = ["derive"] }
+
+# Platform-specific dependencies
+[target.'cfg(unix)'.dependencies]
+nix = "0.27"
+
+[target.'cfg(windows)'.dependencies]
+winapi = { version = "0.3", features = ["winuser"] }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+core-foundation = "0.9"
+```
+
+#### Package Manager Conflicts
+- **APT (Debian/Ubuntu)**: Conflicts with existing packages, dependency versions
+- **RPM (RHEL/CentOS/Fedora)**: Different naming conventions, requires explicit dependencies
+- **Pacman (Arch)**: AUR package maintenance, user expectations for PKGBUILD standards
+- **Homebrew**: Formula maintenance, bottle building for pre-compiled binaries
+
+### Build Infrastructure Constraints
+
+#### GitHub Actions Limitations
+- **Runner Availability**: Limited self-hosted runners for macOS builds
+- **Build Time Limits**: 6-hour job timeout for complex builds
+- **Storage Limits**: Artifact storage and retention policies
+- **Concurrency Limits**: Parallel job execution restrictions
+- **Network Bandwidth**: Large binary upload/download constraints
+
+#### Resource Requirements
+- **Memory Usage**: Cross-compilation can be memory-intensive
+- **CPU Time**: Multi-architecture builds require significant compute
+- **Storage Space**: Build cache management across platforms
+- **Network I/O**: Dependency downloads and artifact uploads
+
+## User Experience Constraints
+
+### Installation Simplicity
+
+#### One-Command Installation Goals
+```bash
+# Ideal user experience
+curl -fsSL https://install.terraphim.ai | sh
+
+# Should handle automatically:
+# - Platform detection
+# - Architecture detection
+# - Package manager selection
+# - Dependency resolution
+# - Service configuration
+# - User setup
+```
+
+#### Package Manager Integration
+- **Zero Configuration**: Default settings work out of the box
+- **Service Management**: Automatic systemd/launchd service setup
+- **User Permissions**: Appropriate file permissions and user groups
+- **Path Integration**: Proper PATH and environment setup
+- **Documentation**: Manual pages and help system integration
+
+### Update Reliability
+
+#### Auto-Updater Requirements
+- **Atomic Updates**: Never leave system in broken state
+- **Rollback Support**: Ability to revert to previous version
+- **Configuration Preservation**: User settings survive updates
+- **Service Continuity**: Minimal downtime during updates
+- **Progress Indication**: Clear feedback during update process
+
+#### Update Failure Scenarios
+- **Network Interruption**: Handle partial downloads gracefully
+- **Disk Space**: Verify adequate space before update
+- **Permission Issues**: Handle permission denied scenarios
+- **Service Conflicts**: Manage running services during update
+- **Dependency Conflicts**: Resolve version incompatibilities
+
+### Performance Expectations
+
+#### Binary Size Constraints
+| Component | Target Size | Current Size | Optimization Opportunities |
+|----------|-------------|--------------|---------------------------|
+| Server   | < 15MB      | 12.8MB       | Strip symbols, optimize build |
+| TUI      | < 8MB       | 7.2MB        | Reduce dependencies |
+| Desktop  | < 50MB      | 45.3MB       | Asset optimization |
+| Docker   | < 200MB     | 180MB        | Multi-stage builds |
+
+#### Startup Performance
+- **Server Cold Start**: < 3 seconds to ready state
+- **TUI Response**: < 500ms initial interface
+- **Desktop Launch**: < 2 seconds to usable state
+- **Container Startup**: < 5 seconds to service ready
+- **Memory Usage**: Server < 100MB baseline, Desktop < 200MB
+
+## Security Constraints
+
+### Code Signing and Verification
+
+#### Platform-Specific Requirements
+- **macOS**: Apple Developer certificate, notarization required
+- **Windows**: Authenticode certificate, SmartScreen compatibility
+- **Linux**: GPG signatures for packages, repository trust
+- **Docker**: Content trust, image signing support
+
+#### Certificate Management
+- **Certificate Renewal**: Automated renewal before expiration
+- **Key Rotation**: Secure private key management practices
+- **Trust Chain**: Maintain valid certificate chains
+- **Revocation Handling**: Respond to certificate compromises
+
+### Security Validation Requirements
+
+#### Vulnerability Scanning
+- **Dependency Scanning**: Automated scanning of all dependencies
+- **Container Scanning**: Docker image vulnerability assessment
+- **Static Analysis**: Code security analysis tools integration
+- **Dynamic Analysis**: Runtime security testing
+
+#### Integrity Verification
+- **Checksum Validation**: SHA256 for all release artifacts
+- **GPG Signatures**: Cryptographic verification of releases
+- **Blockchain Integration**: Immutable release records (future)
+- **Reproducible Builds**: Verifiable build process
+
+## Performance Constraints
+
+### Build Performance
+
+#### Parallelization Limits
+- **Matrix Strategy**: Optimal parallel job distribution
+- **Dependency Caching**: Effective build cache utilization
+- **Artifact Distribution**: Efficient artifact sharing between jobs
+- **Resource Allocation**: Balanced resource usage across jobs
+
+#### Build Time Targets
+| Component | Current Time | Target Time | Optimization Strategy |
+|-----------|--------------|-------------|----------------------|
+| Server Binary | 8 min | 5 min | Better caching |
+| Desktop App | 15 min | 10 min | Parallel builds |
+| Docker Image | 12 min | 8 min | Layer optimization |
+| Full Release | 45 min | 30 min | Pipeline optimization |
+
+### Runtime Performance
+
+#### Resource Utilization
+- **CPU Usage**: Efficient multi-core utilization
+- **Memory Management**: Minimal memory footprint
+- **I/O Performance**: Optimized file operations
+- **Network Efficiency**: Minimal bandwidth usage
+
+#### Scalability Constraints
+- **Concurrent Users**: Support for multiple simultaneous connections
+- **Data Volume**: Handle growing index sizes efficiently
+- **Search Performance**: Sub-second response times
+- **Update Frequency**: Efficient incremental updates
+
+## Compliance and Legal Constraints
+
+### Open Source Compliance
+
+#### License Requirements
+- **MIT/Apache 2.0**: Dual license compatibility
+- **Third-Party Licenses**: SPDX compliance for all dependencies
+- **Attribution**: Proper license notices and acknowledgments
+- **Source Availability**: Corresponding source code availability
+
+#### Export Controls
+- **Cryptography**: Export control compliance for encryption features
+- **Country Restrictions**: Geographical distribution limitations
+- **Entity List Screening**: Restricted party screening processes
+
+### Privacy and Data Protection
+
+#### Data Handling Requirements
+- **User Data**: Minimal data collection and processing
+- **Local Storage**: No unnecessary data transmission
+- **Data Retention**: Appropriate data lifecycle management
+- **User Consent**: Clear privacy policies and consent mechanisms
+
+## Operational Constraints
+
+### Monitoring and Observability
+
+#### Release Monitoring
+- **Download Metrics**: Track installation and update success rates
+- **Error Reporting**: Automated error collection and analysis
+- **Performance Metrics**: Real-time performance monitoring
+- **User Feedback**: In-app feedback collection mechanisms
+
+#### Support Infrastructure
+- **Documentation**: Comprehensive installation and troubleshooting guides
+- **Community Support**: Issue tracking and response processes
+- **Knowledge Base**: Self-service support resources
+- **Escalation Process**: Clear support escalation procedures
+
+### Maintenance Constraints
+
+#### Long-Term Support
+- **Version Support**: Multi-version support strategy
+- **Security Updates**: Backport security fixes to older versions
+- **Deprecation Policy**: Clear component deprecation timelines
+- **Migration Paths**: Smooth upgrade paths between versions
+
+This constraints analysis provides the foundation for understanding the boundaries and requirements that the release validation system must operate within. Each constraint represents a potential failure point that must be monitored and validated during the release process.