feat: harden chat state by tenant

packages/casan-control-panel/README.md

@@ -69,9 +69,9 @@ Governed Chat (Plan-18 MVP-0/1/2):
   with role visibility; selected agent/skill/delegation are bound by harness
   `chat-agent-resolver.py`.
 - `GET /api/v1/chat/audit/verify` — verifies the chat audit hash chain.
-- `GET /api/v1/chat/replay?chatId=<id>` — verifies chat-chain integrity,
+- `GET /api/v1/chat/replay?chatId=<id>&tenant=<id>` — verifies chat-chain integrity,
   evidence artifact hashes, and OPERATOR loop trace replay through harness
-  `chat-replay.py`.
+  `chat-replay.py`; non-default tenants read only their tenant partition.
 - `GET /api/v1/command` — includes the `chat_loop` Command Center widget backed
   by chat audit/replay evidence, loop ticker rows, and token budget gauge.
 - Delegation escalation returns `ESCALATED` and creates a pending `chat.escalate`
@@ -79,6 +79,9 @@ Governed Chat (Plan-18 MVP-0/1/2):
 - CODEGEN requests are draft-only: `codegen-draft` outputs a state artifact, runs
   `artifact-scan.sh` + `tool-output-scan.sh`, certifies through Plan-17 loop-run,
   and never writes to the source tree.
+- Non-default tenant chat state is resolved through `tenant-store.sh`; replay path
+  overrides are guarded, audit snapshots are encrypted with `tenant-crypt.sh`, and
+  tenant kill-switch/quota checks run before chat work.
 - `/chat` UI shows actor/role scope, `mode/risk/decision` badges, certified answer,
   evidence sources, registered operator actions, agent binding, loop certification,
   codegen draft scan status, action-gate status, router details, and audit hash. Side-effect requests outside