Dashboard v1 phase 5 (#280): portable open/import/export + transactional import planner

[BorisTyshkevich]

Part of #280 (Dashboard as a first-class module). Phase 5 of 6, after Phases 1–3. Normative spec in #280.

Goal

PortableBundleV1 becomes the only newly-written interchange format, with dependency-closure export, a transactional import planner with complete ID remapping, and resource-oriented Open / Import queries / Import Dashboard / Replace workspace operations replacing the ambiguous Append.

Scope (from #280 "Phase 5: portable open/import/export")

• Export: Dashboard dependency closure (tiles in semantic order, then filter sources; each query once; no unrelated queries; no Setup dependencies) and full-workspace export preserving catalog order — both through the Phase-1 canonical encoder. Export never mutates identity or revision.
• Transactional import planner (PortableBundleImportPlan) with the required order: parse → schema validation → select dashboard → dependency closure → conflict detection → decisions → complete ID mapping → rewrite every reference centrally → candidate workspace → validate → commit atomically. Conflict actions: use-existing (automatic only on canonical-equality), copy (new ID + full reference rewrite), replace, skip (query-only; skipping a required Dashboard dependency invalidates Dashboard import).
• Multi-dashboard bundles: Open/Import asks which dashboard (import resolution, not multi-dashboard UX).
• Legacy Library v1/v2 decoding normalizes to an in-memory bundle with dashboards: []; legacy formats stay readable; no new Library-only JSON is written (src/ui/file-menu.ts / src/core/saved-io.ts rework).
• External-bundle trust preflight per Make Dashboard a first-class module with one-dashboard-per-current-workspace v1 UX #280 "External bundles are untrusted executable input": explicit "Run Dashboard on " confirmation, never auto-execute, complete validation before any query, row/byte caps, bounded concurrency, no partial execution of an invalid bundle.

Dependencies

Phases 1–3 (schemas, repository, whole-workspace validation). Viewer preflight execution lands with/after Phase 4.

Tests

Per #280 "Open, trust, import, and remapping": copy rewrites tile + filter references; use-existing only on canonical equality; skipped required dependency invalidates import; rewritten candidate validates before atomic commit; invalid bundle executes zero queries; preflight shows host + execution summary.

Acceptance

• All Make Dashboard a first-class module with one-dashboard-per-current-workspace v1 UX #280 import/export/ordering acceptance points; Append UX gone; README/CHANGELOG updated for the new file operations.