Show a workload's possible creation constraints (#411 Q2, view) #529

Problem

#528 computes which of a namespace's quotas and LimitRanges a workload's next Pod could run into (possible_constraints), but the :blocked view does not show it yet. The design's fourth section, "Possible constraints" (docs/superpowers/specs/2026-10-30-creation-constraints-design.md), is still missing from the screen.

Goal

The view half of Q2:

• A "Possible constraints" section after the LimitRanges, one row per possibility:
  • the policy it comes from;
  • what it is about;
  • the finding;
  • the detail.
    Enter opens the policy. A claim row says it holds only if the claim is created.
• Notes:
  • that LimitRange Container defaults were applied to what the template leaves unset;
  • "No ResourceQuota or LimitRange observed constrains this template" only when the core concludes it;
  • otherwise, why that is not established: lists not all read, a RuntimeClass, a claim without a storage class;
  • that a possibility is never a cause or a forecast;
  • that the possibilities are not established when the template could not be read.
• The version-matrix scenario checks the blocked Deployment's possible constraint against the real cluster.
• Docs: docs/tui.md, docs/keybindings.md and the release notes.

Done when

The view shows the section and notes, the tests and the matrix scenario pass, and the docs describe it. #411 can then close.

Part of #411.