feat(packaging): non-invasive embedded layout + ARM/ARA projector + formalize/lock-check

[atom525]

Summary

Implements PR #675 — the non-invasive ARM/ARA → Gaia projection design — end to end:

• Non-invasive embedded layout for Gaia knowledge packages: a host directory becomes a Gaia package by adding only two reserved sub-folders — gaia/ (user-authored DSL + gaia.toml identity) and .gaia/ (generated artifacts). The host's own pyproject.toml, src/, ARM/ARA logic/, evidence/, etc. stay untouched. No -gaia distribution-name suffix required.
• Deterministic ARM/ARA projector (spec §6 / §7 / §11) that turns ARM bundles (arm_manifest.json, knowledge/claims.json, characterization.json) and ARA artifacts (PAPER.md, logic/claims.md, logic/related_work.md, logic/problem.md, logic/experiments.md, evidence/tables/*, trace/exploration_tree.yaml) into compilable Gaia source plus the spec §9 / §10 audit spine (.gaia/source_map.json, .gaia/formalization_queue.jsonl).
• Scaffold → formal upgrade workflow (spec §5.2): gaia pkg formalize walks the queue and turns depends_on(...) scaffolds into infer(...) / derive(...) warrants, linked back through materialize(...) so the audit chain stays intact and the upgrade is reversible.
• Publish gate (spec §5.3 + §16 Phase 3): gaia pkg lock-check validates source-hash freshness, manifest freshness, queue cleanliness, and refuses to ship while any infer(...) warrant still carries the placeholder TODO(reviewer) marker; gaia pkg register --locked runs the gate as a precondition.
• Backward-compatible migration: gaia pkg migrate [--remove-legacy] ports a legacy [tool.gaia] + src/<import>/ package to the embedded layout and produces byte-identical IR.

Verified end-to-end on the shipping examples

galileo  legacy   = sha256:2af089c126f39eebadef8922ce8a3b8160ad91963db41490ccc071a6f10185e8
galileo  embedded = sha256:2af089c126f39eebadef8922ce8a3b8160ad91963db41490ccc071a6f10185e8
galileo  migrated = sha256:2af089c126f39eebadef8922ce8a3b8160ad91963db41490ccc071a6f10185e8
mendel   legacy   = sha256:c17b0f01a1d3706cbbb91dde3ff76d4684dc5d82a7c168b120ba7d016296adad

Spec coverage (PR #675)

Section	Status	Implementation
§2 first principles	✅	layout / loader / mount split
§3.1 native embedded layout	✅	gaia/ + .gaia/
§4 CLI semantics	✅	gaia build init --embedded + gaia pkg mount
§5.1 scaffold mode	✅	gaia.engine.projector.{generic,ara,arm}
§5.2 formalized mode CLI	✅	gaia pkg formalize (interactive + --auto-accept rules)
§5.3 locked mode	✅	gaia pkg lock-check, register --locked
§6 ARM projection rules	✅	gaia.engine.projector.arm
§7 ARA projection rules	✅	gaia.engine.projector.ara (PAPER, claims, evidence, related_work, problem, experiments, trace)
§9 source_map schema	✅	gaia.engine.projector.api.render_source_map
§10 formalization_queue schema	✅	QueueItem.to_json
§11 deterministic projector algorithm	✅	project_host(...)
§14.1 ARA scholarly vs registry refs	✅ for source_only; future for candidate_match / registry_match (needs registry resolver)
§16 Phase 0/1 embedded resolver	✅	gaia.engine.packaging._load_embedded_package_modules
§16 Phase 3 register for embedded	✅	gaia pkg register --locked reads gaia.toml.[package].uuid

Component reuse (audited)

Every new CLI verb / projector module reuses existing Gaia engine surface where one exists — gaia.engine.packaging.{load_gaia_package, apply_package_priors, compile_loaded_package_artifact, build_package_manifests, validate_fills_relations, write_compiled_artifacts}, gaia.engine.ir.validator.validate_local_graph, gaia.engine._stale_check.check_compiled_artifacts, gaia.cli.commands.author._envelope, gaia.engine.lang DSL. A new gaia.engine.codegen module re-exports the author CLI's writer helpers (_ensure_engine_lang_imports / _maybe_update_all_block / _move_all_to_end) so projector-generated source and author-CLI-written source share a single canonical shape.

Test plan

• make test (pr_gate slice) — 952 passed / 15 skipped / 0 failed locally
• uv run mypy --strict — clean on 142 source files
• uv run ruff check . + ruff format --check . — clean
• uv run python scripts/check_ir_schema_bump.py — clean
• uv run python scripts/check_suppression_budget.py — clean (budget bumped 27 → 47 with per-commit justification)
• Live IR-hash parity on examples/galileo-v0-5-gaia (legacy = embedded = migrated)
• Live IR-hash parity on examples/mendel-v0-5-gaia (legacy)
• Live end-to-end on a synthetic ResNet-shape ARA host: mount → projector → formalize → compile → infer → lock-check
• Adversarial test: missing source file ⇒ register --locked blocks before any registry side effects
• Reproject preserves user edits to gaia/__init__.py + sibling user modules; only gaia/from_*/ is rewritten

15 new tests under tests/test_embedded_layout.py, tests/test_projector_ara.py, tests/test_pkg_migrate.py, tests/test_pkg_formalize_lock.py, tests/test_cross_layout_fills.py — all marked pr_gate.

Known future-work boundaries (out of scope for this PR)

• LLM-backed --formalize agent mode — the deterministic surface and the --auto-accept rule:action interface are in place; the LLM agent is a separate package.
• candidate_match / registry_match states for ARA related_work — needs a real Gaia registry resolver (DOI / arXiv lookup); current implementation ships source_only only.