Feat: separate stable repository QA context from pull request delta

[ivory-code]

Summary

• Split reusable repository QA facts into canonical repository, manifest, validation, and behavior blocks.
• Give stable context and the current pull request delta separate content-derived identities.
• Preserve complete evidence in the private local recovery report while keeping agent output within the 4 KB contract.

Behavioral Contract

qa --format agent now emits an additive qamap.context v1 contract. Equivalent repository facts keep the same stable IDs across pull requests, while changed manifest policy, validation commands, behavior structure, or repository identity invalidate only their owning block. Compact payloads retain the aggregate stable ID, delta ID, omitted block count, and local recovery path. Static QA remains not-run until an exact repository command is explicitly executed.

Evidence

Closes #200

• Positive coverage: equivalent repository context retains identity across reordered inputs, different pull request deltas, and equivalent HTTPS or SSH remotes.
• Negative coverage: repository, validation, and behavior changes invalidate only the expected context blocks.
• Output coverage: compact and full agent reports validate against the additive schema and preserve current working-tree contracts.

Checks

• Focused regression test
• pnpm test
• pnpm bench:ci for inference, routing, trace, or output
• Documentation links and commands verified

Public OSS Check

• No private repository, source, path, customer data, credential, or internal smoke output is included.
• Shared inference has unrelated positive and negative coverage, or this is not applicable.
• User-facing commands and claims match actual behavior.

Review Notes

• pnpm bench:execution: N/A. No E2E compiler or execution behavior changed.
• pnpm scan: N/A. No scanner or repository security policy changed.
• pnpm plugin:check and pnpm plugin:smoke: N/A. No plugin package changed.
• The reviewed manifest remains the durable source of team QA policy. This change does not add a second persisted policy store.