feat(stage-workingset): durable, replay-safe stage working set (slices 1-4)

Stage agents were spending most of their turn budget re-discovering files
already known from prior stages/attempts. Root cause: nothing durable carries
acquired knowledge across handoffs and retries. First four slices of the fix:

- core:sourcedesc — new dependency-free module: describe(path, bytes) derives
  comment-free structural navigation metadata (module, bounded symbols, bounded
  imports, versioned format). Deliberately non-prose: descriptors are derived
  from agent-writable files and rendered into successor-stage context, so
  comments/docstrings/literals are excluded to close a prompt-injection channel.
  CAS post-image hash stays authoritative; descriptor is disposable navigation.

- kernel retry-repair state (ContextFeedback): on retry, name the authoritative
  CAS images of files this stage already wrote so the agent patches them instead
  of re-reading to rediscover them.

- kernel file-written manifest (SessionOrchestratorArtifacts): each produced
  file surfaced with its authoritative CAS image plus a comment-free structural
  descriptor (via core:sourcedesc, over recorded CAS bytes — replay-safe).

- apps/server RepoMapIndexer: route the injected repo-map descriptor through the
  comment-free describe(). Previously scraped leading comments, which were
  embedded into L3 and surfaced verbatim to successor stages — an injection
  channel from one stage into the next. Structural facts (module + imports +
  symbols) remain as the retrieval signal.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/server/build.gradle

@@ -26,6 +26,7 @@ dependencies {
     implementation project(':core:inference')
     implementation project(':core:transitions')
     implementation project(':core:context')
+    implementation project(':core:sourcedesc')
     implementation project(':core:validation')
     implementation project(':core:risk')
     implementation project(':core:artifacts')