[codex] compile packets from repository evidence

[TheGreenCedar]

Closes #2106
Refs #2098

Context

PR #2103 repaired the Horizon A substrate and removed benchmark-shaped packet policy. This separate Horizon B slice wires the repository-derived compiler promised by the frozen 0.18 evidence-compiler plan. It does not establish product usefulness or authorize a release.

Base: 7794d6e2696450a683163b3926842b44f7aa4b38

Head: e51b6389f43eb1196ae711b702defa110720464b

Tree: 14416957638a8f749a3b669872bd882b1292dd6b

What changed

• Added the typed RetrievalSeedPlanV1 -> PacketCandidateDescriptorV1 -> PacketAdmissionReceiptV1 -> PacketCompilationInputV1 -> PacketEvidenceProductV3 boundary.
• Kept the unchanged question only as a generic retrieval seed. Raw question text has no exact-selector authority: only typed path, canonical-ID, qualified-symbol, file-symbol, and continuation probes can create exact selectors. Typed free queries remain generic retrieval seeds.
• Added a pure compiler over admitted identities, hydrated source, certain typed relations, ambiguity, gaps, and one publication identity.
• Made selection repository-derived: exact admission order, versioned retrieval order, distinct paths, source containment, a bounded directed relation forest, parser completeness, and deterministic byte cost.
• Hydrates source and the induced certain relation set directly from all and only admitted identities before presentation or output-budget mutation. Legacy citations and graph projections cannot select compiler evidence.
• Authenticates admitted sidecar identities against the same pinned core before they may appear in source, relations, gaps, or continuations. Malformed and stale identities fail closed without exposing their spelling.
• Reads source coverage one admitted file at a time. Packet compilation no longer opens broad node neighborhoods or repository-wide coverage inventories.
• Preserves one representative of every certain typed relation kind for each directed admitted pair.
• Rejects self-loops and missing symbol bounds, prevents opaque relation IDs or identity spelling from steering semantic selection, and lets file nodes hydrate through their indexed path without invented symbol coordinates.
• Projects raw public node IDs that round-trip through existing context surfaces; path identities never masquerade as symbol IDs.
• Keeps continuations stable and typed. Inline code, diagnostic prose, arbitrary Markdown containers, and fenced logs never become exact selectors or continuation queries, and production still reports answer_sufficiency: not_asserted.
• Pins every exported packet route across retrieval, admission, hydration, compilation, and projection.
• Updated architecture documentation to the typed-probe-only selector boundary.

How to review

Start at:

1. crates/codestory-contracts/src/compilation.rs
2. crates/codestory-agent/src/packet_plan.rs
3. crates/codestory-agent/src/evidence_compiler.rs
4. crates/codestory-runtime/src/agent/orchestrator.rs
5. crates/codestory-runtime/src/agent/packet_compiler.rs
6. crates/codestory-store/src/storage_impl/mod.rs
7. crates/codestory-agent/tests/repository_evidence_metamorphic.rs

The critical boundary is that PacketCompilationInputV1 cannot carry the question, prompt terms, task class, obligations, roles, carriers, answer stages, or sufficiency policy. With frozen admitted evidence, paraphrase, bijective rename, opaque edge-ID changes, and input permutation cannot change selection shape.

Focused verification

• Agent suites: 78 unit, 5 black-box boundary, 2 production-scoring, and 14 metamorphic tests passed.
• cargo test --locked -p codestory-runtime --lib: 832 passed, 4 ignored.
• CLI architecture contracts: 56 passed.
• stdio protocol contracts: 66 passed.
• Strict all-target clippy for agent, runtime, and CLI: passed.
• Routing, A/B analyzer, plugin, and hostile generalization matrix: 404 passed, 1 Windows-only skip.
• Live packet generalization scan: 103 production files passed.
• Retrieval generalization scan: 368 production files and 1,724 forbidden patterns passed.
• Documentation links, formatting, and git diff --check: passed.
• The independent verifier reran seven selected hostile cases against this exact head and found no remaining counterexample. It confirmed that raw question markup cannot create exact selectors, typed probes remain functional, admitted paths participate in induced relations, rejected retrieval identities stay hidden, and core/retrieval mismatch stops before packet construction.
• All required GitHub checks passed on the exact head.

Earlier unchanged component checks on this branch also passed: contracts 124, store 284, retrieval 406 with 3 ignored, CLI golden path 18, both proof-feature transport profiles, evidence-only conformance, and strict library clippy for retrieval/indexer.

Risk

This deliberately changes packet evidence ordering and removes legacy presentation artifacts as selection authority. The main semantic risk is losing useful evidence that old fitted policy happened to preserve. The next gate is the builder-visible five-arm ablation; this PR itself makes no accuracy claim.

Non-claims

• No version bump, calibration, broad source qualification, packaging, marketplace, or release work was run.
• Historical 18-task, Q2, Dart, and 45/54 results remain contaminated development evidence only.
• This does not prove the packet beats native tools or CodeStory primitives.
• Graph and semantic retrieval have not yet earned default status through ablation.
• The branch remains at 0.17.5.