wip(freestyle/acr): grounding & edit-tool fixes + ACR-compiler experiment

This branch's uncommitted WIP, committed together (entangled at file level).
Distinct pieces of work:

Freestyle QA fixes (this session):
- FileEditTool: pre-validate replace anchor in validateRequest — reject a
  missing/ambiguous target BEFORE the approval gate, mirroring read/write's
  file-not-found / read-before-write pre-checks. Shared not-found/ambiguous
  messages between validate and execute so they can't drift.
- PlanGrounder: add `scanned` flag; when no RepoMapComputedEvent was recorded,
  repoMapPaths is "unknown" not "empty workspace" — skip scope grounding
  (which proves a path ABSENT) so real paths (apps/server/**) aren't falsely
  rejected. Build-manifest check still runs.
- FreestyleDriver: wire scanned=(repoMap!=null); on plan rejection emit a
  session-terminal WorkflowFailedEvent so a rejected run reads FAILED, not the
  COMPLETED-lie (last verdict was the planning-phase WorkflowCompleted).
- ServerModule: resolve project-memory workspace root from the session's bound
  workspace (sessionWorkspaceRoot) instead of boot-static pm.repoRoot(), fixing
  the workspace-binding divergence (correx vs empty scratch dir). Retire tracked
  in Vikunja #266.
- LaunchRegistrationRaceTest: join registered jobs before asserting launchCount
  — computeIfAbsent returns the Job immediately but the fire-and-forget launch
  body lagged awaitAll (the 49-vs-50 flake).

ACR concept-compiler experiment (pre-existing WIP on this branch):
- ExecutionPlanCompiler/Model/PlanLinter, #264 needs-seam (sessionArtifacts),
  LSP diagnostics subsystem (LspDiagnosticEvents/Runner/Lsp4j), BootWorkspace,
  config surface, workflow prompts/schemas, orchestrator advance-don't-rerun.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

testing/kernel/src/test/kotlin/LaunchRegistrationRaceTest.kt

@@ -45,6 +45,10 @@ class LaunchRegistrationRaceTest {
             }.awaitAll()
         }
 
+        // computeIfAbsent returns the Job as soon as it's created; the launched body (which
+        // increments launchCount) runs independently on `scope`. Join the registered jobs so the
+        // increments have happened before we assert — otherwise launchCount races the launch bodies.
+        registry.values.forEach { it.join() }
         assertEquals(1, launchCount.get(), "mapping lambda must execute exactly once")
         assertEquals(1, registry.size, "registry must contain exactly one entry")
         scope.cancel()
@@ -69,6 +73,9 @@ class LaunchRegistrationRaceTest {
             }.awaitAll()
         }
 
+        // Join the launched bodies before asserting: computeIfAbsent returns the Job immediately,
+        // but the increment runs on `scope` independently and may lag awaitAll (the 49-vs-50 flake).
+        registry.values.forEach { it.join() }
         assertEquals(50, launchCount.get(), "each distinct key must execute its lambda")
         assertEquals(50, registry.size, "registry must contain 50 entries")
         scope.cancel()