feat(generation): standardize source access

[Zxf-xufeng]

Which issue or RFC does this close?

Implements #1458. This is a stacked change on #1438 and should be reviewed after the foundational Source and Artifact REST API implementation.

Why is this change needed?

Artifact Create and Replace persist lineage_only Content Sources as durable provenance. Those records must remain available to public and management reads, but they must not feed Artifact generation. The existing Memory, Experience, Skill, Handoff, and Candidate paths read Sources independently, so eligibility and Source-window behavior can drift or be omitted by a new family.

What changed?

• add SourceRepository.get_many for ordered, deduplicated exact reads and list_window for SQL-bounded (after, through] journal reads;
• add a lightweight generation Source access layer that combines strict repository decoding with the existing eligibility rule;
• migrate Memory Flush and Experience incubation to the same bounded-window filtering behavior while preserving full cursor advancement;
• migrate Experience and Skill generation, Candidate Propose/Revise/Approve, Handoff citation resolution, and Handoff activation to the shared explicit admission path;
• batch built-in Handoff Source and Artifact evidence reads while preserving compatibility with existing custom evidence resolvers;
• keep runtime/public Source Get independent from generation eligibility;
• allow the existing internal Content Source target to carry any valid Artifact family string without adding a new field or Source type;
• use a neutral source_not_eligible message and expose only the submitted SourceRef in error details;
• add repository, malformed-payload, explicit rejection, window skip, cursor advancement, Candidate atomicity, public read, and Handoff regression coverage.

User-facing or breaking changes

• Explicit generation with a lineage_only Source now fails atomically with 422 source_not_eligible before model or Artifact writes.
• Journal consumers silently exclude valid lineage_only records and still advance through the selected window; an all-filtered window is a no-op.
• Public and management Source reads can still return the Source. No HTTP success schema, Source type, database table, column, or index is added.

Validation

• make check
• focused Source/Memory/Experience/Skill/Review/Handoff tests: 56 passed
• clean-environment full suite: 1327 passed, 19 skipped, 1 local-service-dependent test deselected; the Linux-only receiver-service test file was excluded on macOS

AI usage

AI was used to trace existing Source consumers, implement the shared access path and repository methods, draft regression tests, and review compatibility boundaries. The code, behavior, and test results were reviewed by the author.