fix(curation): kill dev-artefact leak + rename agent honestly

Oracle remediation batch 1 — closing gaps #1 (agent overclaim), #4
(demo-data leak), #5 (raw-ID exposure):

- src/lib/flowCuration.ts: shared isDevArtefact + curatedPublishedFlows
  filter for the whole codebase. Patterns drop rv_/orphan/Atlas F1/MCP
  SDX/Codex Test/sidekick/process_<ts>/backfill/smoke/probe/fixture and
  the EA2_* internal source_contexts.
- src/scenes/Hub.tsx: loadPublishedFlows uses the shared curator
- src/lib/agentTools.ts: list_processes and start_process both use the
  shared curator; raw transaction_id no longer in start reply
- src/state/store.ts: snapshot + live merges curated; resolveDefaultStepId
  guards against scenarios whose defaultStepId references a stale step
- src/scenes/Wizard.tsx: 'Process definition <hex>' confirmation replaced
  with the user-facing process name
- src/scenes/Hub.tsx: start toast no longer shows transaction_id prefix
- src/scenes/Agent.tsx + App.tsx + Landing.tsx: rename Pi -> FlowMaster
  Command Assistant. Welcome message says explicitly that this is a
  deterministic router and the LLM agent + tenant memory are on the
  roadmap. Tab label, hub chip, turn author all rebranded.
- src/scenes/GeoAttendance.tsx: scene re-titled to 'Attendance map ·
  preview' with honest copy explaining the dataset is illustrative until
  the EA2 attendance feed is wired in.
- src/data/synthetic.ts: orphaned from runtime (kept in tree for tests).
  Snapshot now sources only the live-cached EA2 read (scenarios.json),
  filtered through the same curator.

29/29 tests green. No more 'rv test flow 0' / 'orphan' / 'Atlas F1' / raw
32-char hex IDs visible to a buyer.

src/lib/agentTools.ts

@@ -1,6 +1,7 @@
 import { api } from "./api";
 import { wizardApi } from "./wizardApi";
 import { chatApi } from "./chatApi";
+import { curatedPublishedFlows } from "./flowCuration";
 
 export interface ToolResult {
   ok: boolean;
@@ -72,19 +73,17 @@ const TOOLS: ToolDef[] = [
       const procs = await fetch(`${api.config.baseUrl}/api/ea2/flow/processes?limit=200`, {
         headers: { Authorization: `Bearer ${sessionStorage.getItem("fm.mc.token.v1")}` },
       }).then((r) => r.json());
-      const items: any[] = procs?.items || [];
+      const items = curatedPublishedFlows((procs?.items || []) as any[]);
       const norm = (s: string) => s.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
       const target = norm(processName);
-      const match = items
-        .filter((it) => it.status === "published" && it.kind === "definition")
-        .find((it) => norm(it.display_name || "").includes(target) || norm(it.name || "").includes(target));
+      const match = items.find((it) => norm(it.display_name || "").includes(target) || norm(it.name || "").includes(target));
 
       if (!match) return { ok: false, display: `Couldn't find a published process matching "${processName}". Try the Studio to create one.` };
       try {
         const res = await wizardApi.startInstance(match._key, subject);
         return {
           ok: true,
-          display: `Started ${match.display_name}${subject ? ` for ${subject}` : ""}. Transaction ${res.transaction_id?.slice(0, 8) || "ok"}.`,
+          display: `Started ${match.display_name}${subject ? ` for ${subject}` : ""}.`,
           data: res,
         };
       } catch (e: any) {
@@ -129,12 +128,14 @@ const TOOLS: ToolDef[] = [
     description: "List published processes for this tenant",
     matcher: /^(list|show|what)\s+(processes|workflows|flows)/i,
     async run() {
-      const procs = await fetch(`${api.config.baseUrl}/api/ea2/flow/processes?limit=20`, {
+      const procs = await fetch(`${api.config.baseUrl}/api/ea2/flow/processes?limit=200`, {
         headers: { Authorization: `Bearer ${sessionStorage.getItem("fm.mc.token.v1")}` },
-      }).then((r) => r.json());
-      const published = (procs?.items || []).filter((it: any) => it.status === "published" && it.kind === "definition").slice(0, 10);
-      if (!published.length) return { ok: true, display: "No published processes yet. Build one in the Studio." };
-      const lines = published.map((it: any) => `• ${it.display_name || it.name}`).join("\n");
+      })
+        .then((r) => r.json())
+        .catch(() => ({ items: [] }));
+      const published = curatedPublishedFlows((procs?.items || []) as any[]).slice(0, 10);
+      if (!published.length) return { ok: true, display: "No published processes yet. Open the Studio to design one." };
+      const lines = published.map((it) => `• ${it.display_name}`).join("\n");
       return { ok: true, display: `Here's what's published:\n${lines}` };
     },
   },