Publish harness and TUI open-source

initial sync from the monorepo

third_party/dagre_rust/Cargo.toml

@@ -0,0 +1,56 @@
+# Vendored third-party crate.
+#
+# Upstream:  dagre_rust 0.0.5 (Apache-2.0), as re-published in
+#            warpdotdev/mermaid-to-svg `crates/dagre_rust` ("vendored from 0.0.5
+#            with fixes" per upstream Cargo.toml).
+# Source of truth: https://github.com/warpdotdev/mermaid-to-svg (rev
+#            40cecf2be376e47e15053eadbfb782a531777420), crates/dagre_rust/.
+#            Base crate: https://crates.io/crates/dagre_rust/0.0.5
+#
+# Why vendored: the Rust port of dagre.js (the same layout engine mermaid.js
+# uses). It is the layout core of the Warp `mermaid-to-svg` engine, which renders
+# untrusted model output, so vendoring gives a full audit surface and immunity to
+# upstream yanks. See third_party/mermaid-to-svg and crates/codegen/xai-grok-mermaid.
+#
+# ============================================================================
+# VENDORING NOTES — re-apply / re-bless ALL of the following on every upgrade:
+# ============================================================================
+# Local modifications to the upstream source:
+#  1. `cargo fmt` (rustfmt) applied so the crate satisfies the workspace fmt
+#     gate; no semantic change. Otherwise the library source (`src/**`, incl. one
+#     in-source unit test in `src/layout/util.rs`) is the `mermaid-to-svg`
+#     in-repo copy; the `graphlib_rust` / `ordered_hashmap` deps are repointed to
+#     the sibling vendored crates.
+#  2. UNSAFE REMOVAL (src/layout/util.rs): the upstream unique-id counter was a
+#     `static mut UNIQUE_STARTER` incremented inside an `unsafe` block with no
+#     synchronization — a data race whenever the engine renders on more than one
+#     thread (e.g. the parallel `cargo test` suite). Replaced with a
+#     `std::sync::atomic::AtomicUsize` (`fetch_add`); behaviour-preserving (still
+#     hands out monotonic unique ids) and it removes the only `unsafe` here.
+#
+# Re-audit checklist:
+#  - No `unsafe` remains (the `static mut` counter became an `AtomicUsize`; see
+#    local modification 2), and no filesystem / env / network I/O in the source.
+[package]
+name = "dagre_rust"
+version = "0.0.5"
+edition = "2021"
+description = "Dagre layout in Rust (vendored, library-only)"
+license = "Apache-2.0"
+repository = "https://github.com/r3alst/dagre-rust"
+publish = false
+
+[lib]
+name = "dagre_rust"
+path = "src/lib.rs"
+doctest = false
+
+[dependencies]
+graphlib_rust = { path = "../graphlib_rust" }
+ordered_hashmap = { path = "../ordered_hashmap" }
+
+# Clippy lints local/path crates (this vendored crate is one) under the
+# workspace's `-D warnings`. We do not restyle upstream third-party code, so
+# allow clippy here; our own crate (xai-grok-mermaid) is still fully linted.
+[lints.clippy]
+all = { level = "allow", priority = -1 }