refactor: seal remaining domain boundaries

[morluto]

Description

Continue #282 by removing the remaining loose executable and durable representations. Broad CLI, MCP, GitHub, archive, JSON, and storage inputs are now parsed once into narrow product-owned values; downstream operations receive sealed selections and state variants instead of strings, boolean combinations, or mutable bags that must be revalidated.

The change centers ownership in four places:

• application and corpus boundary parsers own search, sync, setup, upgrade, lifecycle, tracking, contribution, actor, feedback, and response-format modes;
• durable models own strict JSON decoding for jobs, concerns, evidence, manifests, projections, clusters, workspaces, provenance, and recovery payloads;
• MCP contracts own typed status, resource, provenance, and recovery values while adapters preserve the existing public JSON field names and strings;
• migration 016 retires the orphaned crawl-frontier representation and its unused application layer, with the rationale captured in ADR 0006.

This also removes production dependency overrides used only by tests, splits mixed actor/job/batch hubs into operation-owned variants, and keeps arbitrary maps only at genuinely heterogeneous boundaries such as MCP error examples, GraphQL variables, measurements, and sanitized metadata.

Several correctness gaps fell out of the ownership work: malformed GH Archive event filters now fail before a run is created; incomplete pull-request feedback coverage cannot become negative evidence; contradictory workspace, snapshot, provenance, and coverage states are rejected at decode time; parsed setup JSON preserves number precision and rollback ownership; and the advertised MCP batch-item enum now includes the partial value that producers can emit.

Testing

• make verify passes
• Focused regression coverage was added or updated at the affected owner boundaries
• make test-race RACE_TEST_PARALLELISM=2 passes across internal/app, internal/corpus, internal/mcpserver, and internal/workspace
• go run golang.org/x/tools/cmd/deadcode@latest -test ./... reports no dead functions
• gitleaks git --log-opts='origin/main..HEAD' reports no leaks
• git diff --check origin/main...HEAD passes

make verify covered go vet, the complete uncached test suite, repository-wide lint with zero issues, module tidiness, generated-output checks, and AGENTS/documentation validation. The default four-slot local race run exhausted the 600-second package timeout under concurrent SQLite load without reporting a race; the contributing guide's documented two-slot setting completed successfully with the same package coverage.

Compatibility and scope

• Storage and side-effect invariants remain intact
• No unrelated cleanup or generated-output churn is included
• No dependency, workflow, or GitHub-mutation capability changes are included

Supported JSON and MCP response shapes remain unchanged. Inputs and stored records that encode contradictory or unknown enum states now fail closed intentionally. Missing, stale, truncated, or unavailable coverage remains unknown rather than becoming negative evidence.

Corpus reads remain offline. GitHub access, filesystem writes, process execution, setup/upgrade activation, and validation authorization remain explicit capabilities. Projection ordering, atomic child replacement, transactional multi-record writes, cancellation, and terminal job ownership are preserved.

Migration 016 removes the unused crawl-frontier table and trigger; its rollback recreates the retired schema shape. No live feature reads or writes that representation.

Diff size: 367 files, 15,696 insertions, 7,206 deletions. The change is large because private constructors and accessors propagate through callers and behavior tests, but it remains one outcome: every executable state has one authoritative parsed owner.

Suggested review order

1. Parsed values and durable codecs in internal/domain, internal/evidence, internal/manifest, internal/concern, internal/research, and internal/workspace.
2. Storage parsing, ordering, transactions, and migration 016 in internal/corpus.
3. Application request variants and lifecycle/authority wiring in internal/app, especially setup, upgrade, jobs, sync, discovery, and PR feedback.
4. MCP contract/schema preservation in internal/mcpcontract and internal/mcpserver.
5. Adapter migrations and behavior-focused regression tests in internal/cli, internal/tui, internal/github, and internal/discovery.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.