Surface reconciliation in the dashboard and keep the view read-only

Two gaps in the baseline-reconciliation feature:

- The dashboard claimed to summarise acknowledged drift, but renderIntegrity()
  never rendered it. Add a `recon` chip to the integrity summary and a
  Reconciliation state-card (accepted/ok/stale counts plus stale items).
- A read-only GET /api/integrity could write the store: list() flushed a
  TTL-lapsed ok->stale transition to disk, violating the read-only dashboard
  invariant. Add list(persist=False) and use it from the web summary path so
  staleness is evaluated in memory without touching the file.

Covered by a new test asserting integrity_report() never rewrites the store.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

enodia_sentinel/reconcile.py

@@ -244,9 +244,11 @@ class ReconcileStore:
 
     # -- queries -----------------------------------------------------------
     def list(self, stale_only: bool = False, live_fps: dict | None = None,
-             now: datetime | None = None) -> list[Record]:
+             now: datetime | None = None, persist: bool = True) -> list[Record]:
         """All records, re-evaluating staleness against TTL and any supplied
-        live state. Persists newly detected transitions (the lazy write-back).
+        live state. Persists newly detected transitions (the lazy write-back)
+        unless ``persist=False`` — the read-only dashboard path needs the
+        recomputed status without touching disk.
 
         TTL expiry is always authoritative. A content-bound (fim/pkgfile) ack is
         only re-checked when ``live_fps`` actually carries that kind's data; with
@@ -257,7 +259,8 @@ class ReconcileStore:
         live_fps = live_fps or {}
         for rec in self._records.values():
             self._refresh_listed(rec, live_fps, now)
-        self.flush_stale()
+        if persist:
+            self.flush_stale()
         out = [r for r in self._records.values()
                if not stale_only or r.status == "stale"]
         return sorted(out, key=lambda r: (r.kind, r.target))