feat(agent-journal): add safe material file observations

[feniix]

Summary

Agent Journal can now bind durable entries to workspace files without asking the model to manufacture hashes, timestamps, workspace IDs, or entry provenance. Public file dependencies are safely reopened and recomputed, propagate into checkpoints, and participate in stale/missing support withholding and append-only resolution while the public surface remains exactly four tools.

This PR also defines the V3 evaluation contract and records an honest terminal infrastructure failure. Real two-condition/two-phase preflight and independent quarantine/scorer review did not satisfy the frozen capsule-provenance, sandbox, attempt-binding, and raw-to-derived requirements, so held-out selection never occurred and product performance remains unadjudicated.

Safety decisions

• journal_record.observe_files accepts only workspace-relative path plus material.
• JournalService computes canonical path, workspace identity, SHA-256, timestamp, and originating entry ID.
• Caller-supplied public file provenance is discarded and recomputed.
• Checkpoints canonicalize file dependencies from persisted originating entries.
• Sensitive paths/content, escapes, symlinks, special files, oversized files, identity changes, and mid-read mutations fail closed.
• Reads are bounded to 2 MiB plus an overflow probe; file bytes are never persisted.
• Batch rejection remains atomic and diagnostics do not echo candidate bytes.

V3 outcome

• Infrastructure accepted: no
• Held-out tasks selected: 0
• Valid product traces: 0
• Product outcome: not adjudicated
• Release/cutover authorized: no
• Synthetic worktrees, sessions, stores, and traces: deleted
• V1/V2 historical hashes: unchanged
• pi-code-reasoning and pi-sequential-thinking: unchanged and active

Validation

• 207 package tests passed across 14 files.
• Coverage: 83.42% statements, 79.11% branches, 90.57% functions, 85.72% lines.
• Repository check:ci passed.
• MCP build and package dry-run passed; zero evaluation/private artifacts packed.
• Spec-document validation and diff hygiene passed.
• Browser testing was not applicable because this package has no browser UI.

---