Add remote semantic claims gateway

[ferueda]

Summary

• add a strict semantic-v1 Vercel AI Gateway route pinned to GPT-OSS 120B on Cerebras
• add the explicit noema analyze claims command with remote approval, bounded input, privacy filtering, and exact reuse
• align the wire schema and response metadata decoder with the live Cerebras and Gateway contracts
• keep zero-retention and no-training as explicit route choices while allowing the current experiment to disable them
• persist only sanitized generation and claim-admission failure categories
• add approved follow-up plans for a live route canary, pinned sampling, and a 12-case semantic evaluation corpus

Why

This completes Milestone 2's first live semantic-claims path while preserving Noema's local-first, fail-closed boundaries. The live smoke exposed differences between the nominal OpenAI-compatible contract and the actual Gateway/Cerebras behavior, plus semantic candidates that were structurally valid but inconsistent with local evidence rules. The change keeps remote output untrusted until local admission and makes failures useful to diagnose without retaining provider bodies or rejected model prose.

Impact

Noema can now turn one stored deterministic fact analysis into validated semantic claims and knowledge events through the pinned Gateway route. Exact reruns reuse the completed analysis. The API key, outbound prompt, raw response, rejected candidate prose, and resolved evidence text are not persisted.

Zero-data-retention and no-prompt-training are explicitly recorded but disabled in the example route for the current experiment. Provider defaults therefore apply; remote execution still requires --allow-remote, a reviewed route file, and an API key.

Live validation

• an explicitly approved 32-entry partial real-session selection completed through Cerebras
• three claims were admitted with exact evidence references
• an exact rerun reused the stored result without another model call
• failed attempts remained inspectable only through bounded sanitized categories

Validation

• make check
• focused Gateway, application, and CLI tests
• all three follow-up implementation plans passed independent plan-review
• prior change-review and docs-drift workflows passed with no findings