BACKLOG — phase `dash`

Build backlog

Root-cause confirmed (Drone 100-build window) + host artifact schema inspected.
M1: rewrite history_for to source from /var/lib/cc-ci-runs local artifacts, newest-first by finished, capped at HISTORY_CAP, malformed/empty dirs skipped, security/other routes unchanged.
M1: unit test for local sourcing (count/order/cap/skip) + full-fixture verify vs real data.
M1: awaiting Adversary PASS in REVIEW-dash.md.
M2: deploy. Procedure (host flake source = /etc/cc-ci git clone): ssh cc-ci 'git -C /etc/cc-ci pull && systemd-run --no-block --unit=ccci-dash-sw --collect --property=Type=oneshot nixos-rebuild switch --flake /etc/cc-ci#cc-ci'. Content-hash image tag rolls dashboard.py change: current deployed 15addbc7bf45 → expected new 11ac2a1e6c07 (sha256sum dashboard/dashboard.py | cut -c1-12). Then verify live on /recipe/bluesky-pds (8 runs) + ≥2 recipes, overview + badges still 200, deploy-dashboard active, host health after.
M2: confirm retention does not trim /var/lib/cc-ci-runs (record in DECISIONS if a cap needed).
DONE: both gates Adversary-PASS in REVIEW-dash.md → write ## DONE in STATUS-dash.md.