[1.0] Explain why a subscription is waiting or did not trigger

Scheduling decisions often end in a continue without an operator-facing reason. Users cannot easily distinguish missing inputs, rejected predicates, capacity waits or component vetoes.

Scope

• Expose a small diagnostic view of existing scheduler decisions for a selected artifact/subscription/run.
• Report applicable reasons from the real decision path, including missing AND input and rejected predicates, without rebuilding matching logic.
• Make the result usable through the API and dashboard and filter details by the reader's permissions.

Acceptance criteria

• A waiting AND gate and rejected predicate are explainable without log searches or model calls.
• Capacity waits and blocked decisions agree with the scheduler's actual state.
• Unauthorized readers learn no protected artifact existence, values or counts from explanations.

Boundaries

No general workflow debugger, replay engine or second scheduler.

References

• Implementation dependencies: #440, #441.
• src/flock/orchestrator/scheduler.py
• src/flock/orchestrator/artifact_collector.py
• src/flock/core/subscription.py

Start with src/flock/orchestrator/scheduler.py, src/flock/orchestrator/artifact_collector.py, and src/flock/core/subscription.py, tracing how waiting, rejected, capacity, and veto decisions are represented. Review dependencies #440 and #441 before defining the diagnostic view. Done means explanations work through the API and dashboard while respecting reader permissions and matching the scheduler's actual state.