FE-1162: Add Petrinaut optimization backend

[kube]

🌟 What is the purpose of this PR?

Add the backend flow for running scenario-parameter optimization through Petrinaut Optimizer and HASH NodeAPI. The contract supports one scenario, one objective metric, and a flat set of fixed or optimized parameters.

🔍 What does this change?

Project / package	Purpose
@apps/hash-api	Adds authenticated capability and optimization routes, request limits, cancellation, and SSE-to-NDJSON streaming.
@apps/petrinaut-opt	Adds the FastAPI/Optuna service that drives Petrinaut CLI over stdio and publishes OpenAPI.
@hashintel/petrinaut-cli	Adds optimization-manifest loading, search-space description, and trial evaluation over JSON Lines.
@hashintel/petrinaut-core	Defines and validates optimization manifests/events and safely executes scenario-based trials.
@local/petrinaut-optimizer-client (new)	Provides generated API types plus shared optimizer HTTP and stream decoding.
@local/repo-chores	Excludes uv virtual environments from workspace license scanning.
Workspace metadata	Adds the Petrinaut Core patch changeset and dependency lockfile updates.

The PR also includes CLI integration documentation and a reproducible supply-chain optimization manifest.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• modifies an npm-publishable library and I have added a changeset file(s)

📜 Does this require a change to the docs?

The changes in this PR:

• require changes to docs which are made as part of this PR

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• affected the execution graph, and the turbo.json files have been updated to reflect this

⚠️ Known issues

• Disconnecting the client cancels the upstream optimization.
• Optimization is limited to one objective metric and a flat scenario-parameter search space.
• Petrinaut scenarios contain user-authored JavaScript and require production isolation.

🐾 Next steps

• Connect the HASH frontend to the NodeAPI optimization stream.

🛡 What tests cover this?

• HASH API route, validation, cancellation, heartbeat, and stream-adaptation tests
• Petrinaut Core manifest, scenario, and execution tests
• Petrinaut CLI protocol and optimization tests
• Shared client decoding, transport, and generated-contract drift tests
• Petrinaut Optimizer API, CLI bridge, study, and status tests

❓ How to test this?

1. Build Petrinaut CLI and the Petrinaut Optimizer image.
2. Run the optimizer on port 4004.
3. Configure NodeAPI with HASH_PETRINAUT_OPT_HOST and HASH_PETRINAUT_OPT_PORT.
4. Verify the authenticated capabilities route, then POST an optimization manifest to /api/petrinaut-optimizer/optimize and inspect the progressive NDJSON response.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hash	Ignored	Preview	Jul 18, 2026 1:48am
hashdotdesign-tokens	Ignored	Preview	Jul 18, 2026 1:48am
petrinaut	Skipped	Comment	Jul 18, 2026 1:48am