fix(kernel,tools,validation): unblock role_pipeline end-to-end + QA audit

Live QA audit of role_pipeline against a sample repo surfaced and fixed a
chain of defects that prevented any tool+artifact workflow from running
end-to-end. The pipeline now completes cleanly with a real, validated,
reviewed file change.

- F-008 workflow: propagate stage token_budget -> generationConfig.maxTokens
  (TomlWorkflowLoader) so large stages stop truncating at the 2048 default.
- F-009 tools/kernel: file_read missing-file is recoverable; recoverable tool
  errors feed back into the loop instead of aborting the stage.
- F-010/F-018 kernel: reject premature stage_complete and nudge the model to
  emit the owed artifact / invoke a write tool (bounded by MAX_TOOL_ROUNDS).
- F-011 schemas: list-typed artifact fields string -> array (analysis/design/
  impl_plan) to match model output.
- F-012 kernel: strip an outer markdown code fence from LLM artifacts.
- F-013 validation: payload-validation failures are retryable; structural
  failures stay terminal (wires the invariant-#7 reject+retry contract).
- F-014 tools: file_edit schema matches its real params; edits emit a diff.
- F-015 kernel: record tool-execution events + materialise a real file_written
  artifact from the on-disk write; gate validation so a no-write stage cannot
  be rubber-stamped (no more false-success runs).
- F-016 server: raise stageTimeoutMs 60s -> 180s for slow local models.
- F-019 artifacts/kernel: file_written artifact carries the unified diff so the
  reviewer can verify the change (shared DiffUtil; file_write emits a diff too).
- F-020 tools: model-correctable file_edit failures are recoverable + steer
  toward replace/file_write over the fragile patch op.

Full findings register (F-001..F-021, incl. open F-021 resume rehydrate bug)
in qa/audit-report-2026-06-08.md. All module tests green.

core/validation/src/main/kotlin/com/correx/core/validation/pipeline/ValidationPipeline.kt

@@ -6,6 +6,8 @@ import com.correx.core.validation.model.ValidationReport
 import com.correx.core.validation.model.ValidationSection
 import com.correx.core.validation.model.ValidationSeverity
 
+private const val ARTIFACT_PAYLOAD_SECTION = "artifact_payload"
+
 class ValidationPipeline(
     private val validators: List<Validator>,
     private val approvalTrigger: ApprovalTrigger? = null
@@ -17,8 +19,12 @@ class ValidationPipeline(
             val section = validator.validate(context)
             sections += section
             if (section.issues.any { it.severity == ValidationSeverity.ERROR }) {
-                // Structural validation errors are not retryable — the graph must be fixed.
-                return ValidationOutcome.Rejected(ValidationReport(sections), retryable = false)
+                // Distinguish failure classes: a malformed/schema-invalid LLM artifact is
+                // retryable (the model is nondeterministic — a fresh attempt usually succeeds,
+                // up to the stage's max_retries; this is the invariant #7 "reject + retry"
+                // contract). Structural/graph errors are not retryable — the graph must be fixed.
+                val retryable = section.name == ARTIFACT_PAYLOAD_SECTION
+                return ValidationOutcome.Rejected(ValidationReport(sections), retryable = retryable)
             }
         }
         val report = ValidationReport(sections)