KiroCrew integration: build a knowledge-graph MCP App with AG-UI support

Parent: #580

## Goal

Build a reusable KiroCrew knowledge-graph app that validates KiroCrew's SEP-1865 MCP Apps and AG-UI hosting paths independently of CAO, then use that proven host surface as the foundation for the CAO integrations in #581 and #582.

The knowledge graph should remain KiroCrew-owned application state. When CAO is connected later, the graph may retain stable linkage metadata such as CAO session and terminal identifiers, but CAO remains authoritative for live fleet, terminal, approval, and delegation state.

## Proposed approach

Implement a KiroCrew app/plugin that:

- Renders a useful knowledge-graph view through KiroCrew's existing MCP App host.
- Negotiates the SEP-1865 `io.modelcontextprotocol/ui` extension and serves a `ui://` resource.
- Uses the existing `McpAppFrame` capability bridge for app-to-tool callbacks.
- Projects graph lifecycle changes over AG-UI so reconnect, rehydration, and incremental updates can be tested before CAO is introduced.
- Keeps the iframe mounted while hidden and does not reparent it when changing presentation mode.
- Can be installed or registered as a KiroCrew app/plugin without CAO-specific configuration.

The implementation belongs in the KiroCrew repository. This issue tracks the cross-project integration deliverable because the current user has read-only access to `kirodotdev/KiroCrew`; the resulting upstream KiroCrew issue or PR should be linked here.

## Scope

- Define a minimal knowledge-graph node and edge projection suitable for protocol testing.
- Add an MCP App resource and render command for the graph.
- Validate inline and side-panel presentation through `McpAppFrame`.
- Validate one app-to-tool callback through the callback-secret boundary.
- Emit and consume graph updates through AG-UI.
- Validate reconnect or rehydration without stale or duplicated graph state.
- Document plugin registration, feature gates, and local test setup.
- Produce an upstream KiroCrew issue or PR for the owned implementation.

## Acceptance criteria

- [ ] KiroCrew negotiates `io.modelcontextprotocol/ui` and loads the graph `ui://` resource.
- [ ] The graph renders in a supported inline or side-panel presentation.
- [ ] Switching tabs does not reload the iframe or discard graph state.
- [ ] Closing and reopening the containing panel has a documented restoration behavior.
- [ ] One capability-authorized app-to-tool callback succeeds through `McpAppFrame`.
- [ ] Graph changes are delivered through AG-UI and folded without duplicate nodes or edges.
- [ ] Reconnect or rehydration restores a consistent graph projection.
- [ ] The app/plugin runs without CAO and contains no CAO runtime-state model.
- [ ] Setup and automated protocol tests are documented.
- [ ] The KiroCrew-owned implementation issue or PR is linked.

## Relationship to sibling work

- #581 adds typed CAO fleet control and stores only stable CAO linkage metadata in KiroCrew.
- #582 reuses the proven host path to render CAO's existing MCP Apps and validate CAO AG-UI interoperability.

## Non-goals

- Reimplementing CAO session, terminal, delegation, approval, or fleet state.
- Building a CAO-specific dashboard.
- Replacing KiroCrew's existing MCP App iframe host.
- Expanding CAO's generative UI component allow-list.

Start with the existing MCP App host and McpAppFrame capability bridge described in the issue, then review parent #580 and sibling issues #581 and #582 for integration boundaries. The work is complete when the KiroCrew-owned issue or PR is linked and the listed protocol, presentation, callback, AG-UI reconnect, setup, and test criteria are documented and validated without CAO runtime state.

Written by the indexing model from the issue text.