feat(pipeline): add the fact-record pipeline core

[Menci]

The data plane is moving from an onion of nested interceptors to a list of stages over one
immutable record of facts. This is the first of three stacked Pull Requests and it adds the
package everything else will compose. There is no business logic in it — nothing here knows
what a model is — so nothing in the running gateway changes yet.

What a stage is

A stage declares where control may go, and it may declare more than one place. There is no
name for a kind of stage; the fields are the declaration.

return:  { provides }            // answer here, never go down
through: { request, response }   // go down the rest of this pipeline
into:    { request, response }   // hand off to another pipeline, so it is last

through and into are mutually exclusive because of what they mean, so five shapes are
legal and defineStage's five overloads admit exactly those — the overload fixes what next
accepts, rather than a marker boolean or a conditional type. A stage that declared no way down
is handed no continuation at all.

transform is sugar in the execute slot: open for state spanning both directions, then one
function per direction, either of which may be omitted. Omitting one is the common case —
today's interceptors call the continuation 107 times across 68 files and 50 of those are a bare
return run();.

Declarations are checked, never applied

After a stage hands on — in either direction, and on the answering path too — the runner
asserts that every key it declared provides is there and every key it declared consumes,
and did not also declare providing, is gone. Nothing is removed on a stage's behalf: a
declaration that acts cannot also be checked, and checking is the whole of what a declaration
is for.

A key in both consumes and provides is a modify, and that one rule covers both
directions: going down it is a translation taking the source and putting the target at another
key; coming up it is a fork taking ownership of every branch's disposable and handing one of
them onward.

What assembly catches that types cannot

compose(name, stages) reasons over declarations, which are strings — so a pipeline's interior
is not part of its type and a stage written against one fact space drops into a pipeline over
another with no variance question to lose.

compose(reentry):   cache needs in.text, which splitWords consumed above it
compose(bad):       handoff declares 'into' but is not last
compose(shortfall): answersNothing may answer here, but its short-circuit does not provide
                    out.result, which stages above it need
compose(swallowed): swallows consumes out.result on the way up, which a stage above it needs

The first is the load-bearing one: a key an earlier stage consumed cannot be needed below it,
so a translated request cannot re-enter its own chain, and assembly says so rather than a
runtime guard. The entry contract is derived from the stages and asserted when a request
arrives, at run and at every handoff.

Handover

Entering the record is a move. Object.isFrozen cannot be the gate, and both halves of the
reason are load-bearing: freezing a typed array that has elements throws, so the walk skips
them and a skipped value can never satisfy isFrozen; and a shallow builtin freeze satisfies
isFrozen while its children stay mutable. So a WeakSet of handed-over roots is the gate and
Object.freeze is what makes a later write throw.

A handed record is frozen in place rather than copied, so a stage that hands on what it
received hands on the same object — which is what the dump's folding reads.

The dump

Six events, carrying states and never differences, so a reader derives every change and the run
stores none. An object id is taken at first sight and before recursing, which is what makes
a cycle terminate on its second visit. A key that already begins with $ is written with one
more, because a tool's parameters are JSON Schema and $schema, $defs and $ref really do
arrive. Large strings are shared by value, which is the only handle left when a stage
deep-clones a payload. A secret is stored as {length, redacted, hash} and never as itself.

Two things worth reviewing closely

The run context is threaded, not ambient. A module-level variable saved and restored around
an await interleaves two concurrent runs — one dump lost, the other holding both, one
stageId issued twice — and a gateway serves concurrent requests by definition.

The disposal sweep runs in finally. A stage that throws must not abandon an open upstream
body: an aborted connection cannot be reused and leaves its billing unsettled.

Tests

54 tests plus two compile-time assertions (a through stage's next takes one argument; a
provider's own key is unreachable from a gateway-only pipeline). Among them the one property
nothing else in the system guards:

on a 49-message conversation with one message rewritten,
48 of 51 objects come back by identity — so the layer costs 3 objects, whatever the length

A stage rewritten to rebuild unconditionally drops that to zero while every other test passes.

What comes next

PR 2 migrates the six non-chat families, and is where passthrough-serve.ts is deleted — those
endpoints forward a body they have not parsed, and the architecture has no such concept. PR 3
migrates chat, which does not divide further: translation couples the four protocols, and the
two shims are elements of the interceptor array rather than things beside it.