BridgeGraph: Pick<Graph, "subscribeCommits" | "snapshot" | "snapshotAt" | "now">

Capability slice handed to connectDevtools.

Closes #364: the bridge is a view, not an editor — the doc-block above (and applyJumpHandler's comment) argue at length that time travel must be a read through snapshotAt, never a mutation through commit, because a panel-driven mutation would forge a fractional or out-of-order time. The full Graph parameter that #257 left in place contradicted that comment: it let a future bridge edit silently call graph.commit(...), graph.input(...), graph.hydrate(...), or graph.derived(...) and reduced the discipline to a code-review hope. Per §12.3 the parameter exposes exactly the four methods the bridge actually calls: subscribeCommits (forward each commit as an action), snapshot (initial state and per-commit state hand-off to the panel), snapshotAt (time-travel projection), and now (baseline-time stamp).

Narrowing is type-level. A real Graph is still assignable, so the call site keeps working; the discipline is enforced at compile time inside the implementation. The Proxy-based runtime gate narrowCapability from @causl/causl-wasm-ts/internal is not applied here because it deliberately omits snapshot / snapshotAt (its allow-list is read / subscribe / subscribeCommits / now — the read-only slice for application code), and the bridge's authority profile is bridge-specific (it must hand the panel a GraphSnapshot, which narrowCapability does not expose).