Natural-language activity search

The Activity search box on the receipt understands plain English. Type dangerous to find rm / kill / delete / sudo calls, blocked for denials, held for approval requests, or something like failed stripe transfers.

• A built-in concept glossary maps everyday words to the vocabulary events actually use, plus verdict-word matching.
• BM25 runs over tool ids, summaries, reason codes, verdicts, projects, and MCP server labels.
• Local MiniLM semantic reranking ships as an optional dependency; the report falls back to lexical-only when the model runtime is unavailable.
• KYA_SEARCH_SEMANTIC=off disables the model while keeping BM25. Offline mode never downloads a model.

The hosted console runs the same hybrid search server-side (Postgres full-text plus optional embeddings), so a query typed in either place behaves the same way.