[aft-alfonso]

Rich UI campaign slice 5. Occipital can fetch the Rich UI manifest and stored templates in fixed-size chunks over its tool-provider routes:

• rich_ui.manifest_chunk and rich_ui.template_chunk (op form and bare name/arguments form), 128 KiB chunks with total chunk and byte counts; reassembly is checked against the digest, including a two-byte UTF-8 character split across a chunk boundary.
• Only Occipital is admitted, unscoped, self-owned or carried by a core scope; every other principal is refused with principal_not_allowed before any lookup.
• Unknown digests refuse digest_unknown, out-of-range indexes chunk_index_out_of_range, and a held database lock reports database_busy without waiting (never a miss). Refusals are typed protocol errors, never tool-result bodies.

Route tests drive the real module frame loop (channel-0 RouteBind, routed requests). Build server: Windows target check with -D warnings passed.

---

Summary by cubic

Adds rich_ui.manifest_chunk and rich_ui.template_chunk so Occipital can fetch the Rich UI manifest and stored templates in fixed-size chunks over its tool-provider routes.

New Features

• Chunks are 128 KiB with total chunk and byte counts; reassembly is checked against the digest, including a two-byte UTF-8 character split across a chunk boundary.
• Only the reserved:occipital principal is admitted, scoped or unscoped; any other principal gets principal_not_allowed before a lookup.
• Refusals are typed protocol errors with fixed, request-free messages: digest_unknown, chunk_index_out_of_range, database_busy without waiting, and database_unavailable for a missing or poisoned handle.
• Occipital now binds tool-provider v1 routes only; legacy and management-surface binds are refused, and non-carrier routes refuse tool calls with session_not_bound.
• Outside tests the build publishes no manifest yet, so manifest_chunk refuses digest_unknown until publication is enabled.

^{Written for commit ea99096. Summary will update on new commits.}