Add artifact-backed session reuse

[TacoRocket]

Summary

• add artifact-backed session metadata and matching for helper output reuse
• wire helper producers and grouped/family consumers to reuse active-workspace artifacts with visible provenance
• remove or shrink the failed hidden provider-level cache path while preserving scoped command-local behavior
• refresh README positioning and command output goldens for the new metadata

Validation

• GOCACHE=/tmp/ho-azure-gocache go test ./...
• sensitivity sweep on modified publish slice passed with no tracked findings
• targeted staged scan for live/session literals found no matches

Sensitivity note

The broad staged sensitivity sweep still flags deterministic fixture and golden identifiers such as 11111111, 22222222, 00000000, all-9s fixture IDs, and contoso DevOps URLs. I reviewed those as test/golden data, not live environment leakage.

Publish hygiene

Local-only guidance, reference docs, fixture-output, .DS_Store files, and scratch artifact lanes were not staged. The empty docs directory was removed locally before publishing.