feat: extract Cortex domain and SQLite storage

[jmagar]

Summary

• extract reusable Cortex contracts/policy into cortex-domain
• extract donor SQLite persistence into cortex-storage-sqlite with schema/migration parity
• add reusable cortex-ingest-core and pure cortex-inventory contracts needed for downward dependencies
• remove product-layer dependencies, raw-row leakage, and stale lint suppressions from the storage boundary

Wave 2 is intentionally batched into this existing PR because the shared Rust runner pool is saturated.

Key boundaries

• donor baseline: 7edf23fadb94650c2d2a2f9c80111fb44319eea8
• SQLite pin: rusqlite 0.40.2 + r2d2_sqlite 0.35.0
• schema head: KNOWN_SCHEMA_VERSION = 47
• PatternSourceRow and pattern intermediates are crate-private; consumers use fetch_patterns
• cortex-storage-sqlite contains zero dead_code suppressions

Product/storage evidence from 77cf3e5

D13 changes only xtask policy/tests and extraction docs, so product/storage evidence remains the immediately preceding exact implementation head:

• SQLite: 441 passed, 1 intentionally ignored; external consumer 1/1
• workspace Nextest: 3,528/3,528 passed, 4 skipped
• workspace all-features check: passed
• strict Cortex Clippy/rustdoc: passed
• architecture: 44 packages / 95 internal edges
• test siblings: 26 checked trees
• Cargo Deny and pinned fleet contract: passed
• zero tracked upward product-layer storage references
• no same-name semantic struct duplication between domain and storage

Exact-head D13 evidence on 5715089

Fresh CI caught six mechanically extracted donor-parity SQLite modules exceeding Soma's hard file-size ceiling. The fix uses the repository's existing exact-path transitional-limit mechanism, not a crate-wide exemption or weaker CI:

• six exact paths remain warning-visible with tight transitional targets
• neighboring storage modules retain the ordinary 350-line target
• PATTERNS util policy tests: 11/11 passed
• exact CI-equivalent target/debug/xtask patterns: exit 0
• rustfmt, diff hygiene, and xtask check-docs: passed
• Wave 8 explicitly requires splitting all six modules and removing these transitional targets before cutover/publication

Adversarial review

D1-D13 are recorded in docs/cortex-extraction/REVIEW.md. Latest findings:

• D11: internal PatternSourceRow escaped the storage API. Fixed with public fetch_patterns and crate-private intermediates.
• D12: stale narrow dead_code suppressions remained. Fixed; storage now has zero such suppressions.
• D13: six parity-preserved SQLite modules exceeded the hard source-size contract. Fixed for this parity lane with exact-path warning-visible transitional targets; real decomposition is mandatory before final cutover.

D11 and D12 are also explicit Wave 8 terminal regression audits after all planned extraction work: no internal/raw SQLite row may escape again, and storage must still have zero dead_code suppressions.

Fresh CI stabilization on ce544cd

Fresh CI after the D13 fix exposed a pre-existing self-update test race rather than a Cortex regression. The scheduler-sensitive async-executor assertion was replaced with a deterministic unit proof around blocking_transaction, and transaction integration validation is serialized only during the test helper's stage+validate window to avoid intermittent Linux ETXTBSY from concurrent temporary executable validators. Production self-update code is unchanged. Evidence: deterministic regression 25/25; rebuilt transaction suite 38/38; default-parallel rebuilt transaction suite 5/5 complete runs; full soma-self-update --all-targets --all-features tests passed; strict all-target/all-feature Clippy passed with -D warnings.