[pournasserian]

Closes #2574

What

The second slice of F-DSK (#2422): the set view (DSK-03), with the per-item diff rendered progressively (PERF-04). It is read only; approve, reject and revert are the next slice.

• /sets/{id} (ChangeSetView.razor, static server rendering):
  • The rationale as the heading, the state, the initiator, when the set was opened and when it entered its state.
  • The set it reverts as a link, and a rejected set's reason.
  • Sources: a source that is an http or https address is a link with target="_blank" and rel="noopener noreferrer". Anything else, such as a file name, a person or a javascript: address, is text.
  • Checks: says whether the checks failed, and that results per check appear once checks run on every set (CHK-03, F-CHK F-CHK: Check engine with deterministic and LLM-judged checks #2420).
  • Routing: says that routing has not decided. Routing rules (Add routing rules and their evaluation #2565) are not on v2 yet.
  • History: every event whose subject is the set, oldest first, with who acted and when, read through IAuditReader. Refused moves are listed too. The first 200 are shown, with a link to the full history.
  • An unknown id calls NavigationManager.NotFound(), so the page answers 404 with the not-found page.
• ChangeSetItems (Components/Review): the interactive island. It reads IChangeSetDirectory.DiffAsync and renders the merged DiffView. The first 25 items arrive with the prerendered page and the circuit adds the rest in batches. A refused read is reported in place of the items.
• The desk links each set to its view instead of its audit history.

Why

• A static page with one interactive island. PERF-04 needs the circuit only for the diff batches. The rest of the page, including the source links and history, then reads and links without a circuit. The review actions in the next slice can post forms to this page, so a decision does not depend on the circuit (ADR-0006).
• Times from the history. The view reads the set's history anyway, so the opened and state times come from it, the same events IChangeSetLists uses.
• Only web addresses become links. Sources are free text from agents. Linking only http and https keeps javascript: and local paths from becoming clickable.
• Not in this PR: review actions, the routing decision from Add routing rules and their evaluation #2565 once it merges, check results per check, item names in the diff, and keyboard review.

Tests

• bUnit ChangeSetViewTests:
  • The rationale, state, initiator and the two times from the history.
  • Only the web address among four sources is a link, with its target and rel. Openable accepts http and https and refuses javascript:, file:, mailto: and a bare host.
  • The history in order, with a refused move listed.
  • A revert link and a rejection reason.
  • The check and routing notes.
  • An unknown set renders nothing.
  • The island renders the diff with an assigned render mode and reports a refused diff.
  • Logical utilities only.
• DeskTests: a set row links to sets/{id}.
• Integration, host:
  • An anonymous request goes to sign-in, and an unknown set answers 404 with the not-found page.
  • A set of 30 items opened by a user: the desk links to it, and the page shows the rationale, the web source as a new-tab link, no javascript: link and the text source. The history lists opened, submitted and awaiting review. The prerendered island holds the first 25 items, is aria-busy and carries the Blazor marker for the circuit.
  • A rejected revert set shows its reason and links to the published set it reverts.

dotnet build -warnaserror and the full suite pass locally against a postgres:17 container as well as SQLite. One loaded run had eight PostgreSQL and job-lease timing failures in classes this PR does not touch; all 102 tests of those classes passed on a rerun. The batches over the circuit were not checked in a browser here: the prerendered first batch is tested, and #2479 checked the batching on /ui. No new package and no new project reference.

Checklist

• Linked to an issue a maintainer has confirmed
• Targets v2
• Tests or docs updated where behaviour changed
• No tool-generated co-author trailers or footers