refactor: make invalid states unrepresentable

[morluto]

Description

Replace permissive internal data bags with parsed, product-owned values so invalid combinations are rejected at acquisition, JSON, and persistence boundaries instead of being revalidated throughout the application.

The change applies four related rules across the codebase:

• repository identities, merge outcomes, lifecycle states, selectors, coverage targets, telemetry values, recovery actions, and research evidence use private parsed representations;
• missing, unavailable, observed, and truncated states are distinct variants rather than combinations of booleans and nullable fields;
• imports and collection members are fully parsed before writable resources are opened, while multi-record evidence and validation writes are atomic;
• stored workflow JSON is parsed immediately after decoding, with the existing flattened repository Owner/Repo shape explicitly preserved and backward-decoding covered by tests.

The MCP follow-through keeps the official Go SDK responsible for typed tool decoding, JSON Schema validation, structured results, tool-error conversion, cancellation, prompt/resource registration, and stdio transport. GitContribute retains only domain schema refinements the SDK cannot infer: closed recovery unions, cross-field modes, bounds, defaults, and enums. The adapter now explicitly disables the SDK's historical default logging capability because the server does not implement a logging surface, and the redundant mutable schema cache/deep-clone machinery has been removed.

This also removes duplicate code-index metadata, narrows post-job follow-ups to read and poll actions, preserves known projections during partial observations, and keeps sparse archive observations unknown when they cannot form a valid thread projection.

The diff is cross-cutting because constructor and accessor changes propagate through their callers, tests, and adapters. The follow-up commits isolate the MCP SDK cleanup, recovery encoding fix, and CI test topology so each can be reviewed independently.

Testing

• make verify passes
• Focused regression coverage was added or updated where applicable
• make test-race passes
• The race-instrumented stdio E2E flow passes independently
• Changed oversized Go files are below the repository's 800-line growth limit
• git diff --check passes

make verify covered uncached tests, go vet, repository-wide lint with zero issues, module tidiness, generated-output checks, and documentation validation. make test-race passed across internal/app, internal/corpus, internal/mcpserver, and internal/workspace.

Compatibility and scope

• Storage and side-effect invariants remain intact
• No generated-output churn is included
• The official Go MCP SDK remains at the current v1.7.0 release

The durable repository JSON format remains flattened and backward compatible; no migration or new format version is needed. Malformed or contradictory durable records and MCP recovery payloads are now rejected intentionally. Corpus reads remain offline, and no GitHub mutation capability is introduced.

The recovery action wire shape is unchanged. Its encoder now uses a growable buffer instead of computing an allocation capacity from input lengths, removing the overflow path reported by CodeQL.

Diff size: 245 files, 5,680 insertions, 2,413 deletions.

Suggested review order

1. Parsed domain values and durable repository JSON in internal/domain, internal/evidence, and internal/research.
2. Persistence parsing and atomic write boundaries in internal/corpus.
3. Recovery/follow-up unions and schema generation in internal/mcpcontract and internal/mcpserver.
4. Application boundary parsers in internal/app, then adapter migrations and docs/architecture.md.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.