feat(shell): three-pane shell + always-on right metadata rail (E3 · #183)

[hellno]

E3 · Three-pane shell + always-on right rail

Adds the always-on ~300px right metadata rail as the shell's third pane (sidebar · main · rail), contextual to the focused object, and drops the Projects layer. Part of the v4 request-origin IA epic (#179).

Closes #183. Refs #179.

What changed

• shell.rs — three-pane layout. The rail is a fixed-width (RAIL_W = 300) flex_shrink_0 sibling (never collapsible); the main column stays flex_1 + min_w_0, so content overflows neither edge (the no-horizontal-overflow invariant).
• shell_chrome.rs — sidebar regrouped to Wallets · Agents · Connections. Connections is a list-only reserved slot (quiet empty state; deep editing deferred, ADR-0001 / Epic: Dapp connectivity — own the transport (ADR 0001) #44). Selection::Project removed everywhere (enum, sidebar, palette scope line, breadcrumb, render_project_home).
• shell_rail.rs (new) — the rail dispatcher + the "This wallet" body (identity object + honest facts + the live Agent caps ledger from agent_policy) and a light "This agent" body (reuses agent_policy_rows).
• activity_view.rs — the Activity rail: a selected/reviewed pending request's compact clear-signing, else the latest transaction's receipt, else a quiet "No activity yet." It is strictly read-only — approve/deny stay on the feed, so the no-blind-approve invariant is untouched and no new ⌘K action is needed.
• widgets.rs — wire the E1 rail primitives (meta_rail/meta_section/meta_obj/kv_row/origin_header/status_glyph); #[allow(dead_code)] removed where fully wired. kv_row gains a loud Warn value for the unverified-read downgrade (DESIGN §Trust rule 9).
• welcome.rs — shared per_tx_cap_display() renders the Send cap honestly ("denied" / "no limit" / figure), never a false "0 ETH". Fixes the same latent bug in the wallet-home agent card.
• main.rs — window widened to 1200×760 (min 1100×560) so the 460px confirm card (CONFIRM_W) never clips beside the 248 sidebar + 300 rail (248+300+460+padding ≤ 1100).

"Rail" fidelity checklist (docs/research/13-v4-build-plan.md)

• Right rail always present (not collapsible), ~300px, hairline-left; content contextual to focus.
• Three-pane renders at app width — no horizontal overflow; rows clamp (min_w_0 + truncate).
• Projects layer dropped; sidebar groups are Wallets · Agents · Connections.
• Rail updates on selection; no "Nothing selected." while a row is selected.
• "This wallet" body: identity + sync/verified/network + the agent cap ledger. (USD value and block/fee are intentionally omitted — the app/engine holds no USD figure and ActivityRecord no block/fee; the honesty rule forbids inventing them. The golden ref's "Connections" count is likewise omitted until the browser bridge lands.)

Trust invariants (unchanged)

• Rail is read-only — it resolves no record (no blind-approve); approve/deny + the arm-delay confirm stay on the feed.
• Two signal colors only — agent = cyan (origin_header/agent_mark), human = amber. Ambiguous App-origin requests (foreground vs. browser bridge, no domain on the record) render a neutral header, never a false amber human signal.
• Cap enforcement is real — every cap comes from the live agent_policy; no hardcoded/invented number, and "denied"/"no limit" never masquerade as "0 ETH".
• Unverified reads render the loud warn tag in the rail Status row (never quietly "verified").

Definition of Done

• cargo fmt --all --check — clean
• just check — green (clippy -D warnings, both default + tray, plus signerd dev-signerd-bin)
• cargo test --workspace — 406 passed, 2 ignored
• No new/changed dependencies (Cargo.toml/Cargo.lock untouched)
• Adversarial review: a 4-lens verify-looped workflow + a codex GPT-5 xhigh cross-model pass vs the golden ref + the Rail checklist; all confirmed findings applied (per-tx honesty, loud unverified status, neutral App-origin header, trailing Agents section, activity_reviewing focus, copy/doc fixes).

⚠️ Pending before merge

GUI evidence — before/after screenshots (home / activity / tx) off just demo per E0's recipe. Synthetic input can't drive the GPUI app under an agent shell, so these need a human to drive the unlocked app for capture. Holding merge until they're attached.

[hellno]

Live GUI verification (demo fork) — all three rail bodies + two bugs caught & fixed

Drove the unlocked app (just demo, Sepolia fork @ block 10822990) and captured every rail state. The three-pane shell renders exactly to the golden ref, and live QA surfaced two real defects that are now fixed on this branch:

Rail states verified

• This wallet (home) — identity + Balance / Synced / Status: Not verified (loud amber) / Network, the live Agent caps ledger (Kyoto daily · Per-transaction 0.1 ETH, honest — not a false "0"), and Agents: 1 active.
• This transaction (Activity, executed shield) — Kyoto (cyan mark) · shield · confirmed · green status_glyph · "moved 0.02 ETH to your private balance" · Time · Hash.
• Pending request (Activity, over-cap send) — Kyoto proposes (cyan) · Sending 0.5 ETH → 0x7099…79C8 · over per-tx cap · "This can't be undone." Read-only: approve/deny stay on the feed row (⌘↵ / x), never in the rail.
• Sidebar: Wallets · Agents · Connections ("No connected sites yet"), no Projects. STOP reachable on Activity; status strip carries the loud NOT VERIFIED.

Bugs caught in live QA (fixed here)

1. meta_obj clipped the rail address to 0xf39F…… (dropping the trust-critical last 4 chars) — same class as the E2 masthead clip (fix(identity): masthead address no longer clips its last chars (E2 follow-up) #192). Fixed with flex_1 on the object's text column; now renders the full 0xf39F…2266.
2. The 3-pane row used size_full, so an over-tall home surface stretched the row and pushed the sidebar footer (Settings) + the status strip off-screen on home but not Activity — the "Settings comes and goes" jump. Fixed by clamping the row (flex_1 + min_h_0).

fmt clean · just check green (both feature configs) · cargo test --workspace 406 passed · no dep changes.

Screenshots (home / activity-tx / activity-pending) attached below.

[hellno]