recon + sqlglot validator + drill_down package; guard ReAct dimension picks against candidate list

ctrl/k8s/base/api.yaml

@@ -13,6 +13,14 @@ spec:
       labels:
         app: api
     spec:
+      # lng.local.ar resolves to ::1 via the host's dnsmasq → coredns chain,
+      # which is the pod's own loopback (wrong). Override to the kind bridge
+      # gateway so traffic from this pod reaches the host's system Caddy and
+      # gets reverse-proxied to Langfuse on :3000.
+      hostAliases:
+        - ip: "172.19.0.1"
+          hostnames:
+            - "lng.local.ar"
       containers:
         - name: api
           image: nvi-api