Merge feature/workbench-w4-resources into unify/skills-20261112

Conflicts combined W1 (Inbox leaves the Stream for Tasks, Waits on Operator) with W4 (Resources tab): five tabs with Resources, Stream keeps only the Firewall, the inbox hash keeps its redirect; index.html.j2 includes both diffs.js and resources.js.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

orchestrator/kvb_orchestrator/handler.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import re
 import secrets
+import time
 from collections.abc import Callable
 from http import HTTPStatus
 from urllib.parse import urlsplit
@@ -9,6 +10,7 @@ from urllib.parse import urlsplit
 from .diffs import DIFF_BODY_LIMIT
 from .engines import STT_LIMIT
 from .exchange import PLAIN_CSP, Exchange
+from .resources import RESOURCES, sampled
 
 BODY_LIMIT = 1 << 20
 UPLOAD_LIMIT = 50 << 20
@@ -114,6 +116,8 @@ class Handler(Exchange):
             self.answer(lambda: hub.events(self.query()), HTTPStatus.OK)
         elif path == "/api/tree":
             self.answer(hub.repositories, HTTPStatus.OK)
+        elif path == "/api/resources":
+            self.answer(lambda: sampled(hub.kept / RESOURCES, hub.span(self.query(), time.time())), HTTPStatus.OK)
         elif path == "/api/subagents":
             self.answer(lambda: hub.subagents(self.query()), HTTPStatus.OK)
         elif path == "/api/runner/jobs":