feat(graph): add nested keyed expansion

[buger]

Stack

• Stacked on parent Visor PR feat(graph): add managed run ownership #588.
• Base branch: poc/exp-0123-managed-run-ownership.

C4a behavior

Adds bounded two-level scoped keyed expansion: a root component catalog materializes stable component subgraphs, and one generated component node may publish a validated spec-work catalog that materializes stable per-spec subgraphs. The global ready queue pipelines independent work across components and specs at max_parallelism: 3; exact two-segment contexts, parent-qualified identities, descendant-first invalidation, replacement generations, and event-only replay are covered.

Gates

• Final focused gate: 6/6 suites and 126/126 tests passed, with zero snapshots.
• Typecheck: baseline-relative pass with only the four pinned mcp-server.ts TS2589/TS2769 diagnostics at lines 931 and 947 and zero candidate diagnostics.
• Retained first gate: 5/6 suites and 125/126 tests. The sole activeProviders 3-versus-2 failure was independently diagnosed twice as a test-oracle timing defect; the authorized test-only latch amendment then received fresh dual admission before the final gate.
• Diff and protected-path hygiene passed for exactly eight admitted paths.

Explicit nonclaims

• No depth-three or arbitrary recursive expansion.
• No aggregation, denominators, campaign completion, or Proof admission.
• No early intra-attempt handoff, claim revocation, or transitive cancellation.
• No Proof/Probe integration, role or checklist resolution, capability or model routing, or real provider/model execution.
• No retries, leases, budgets, recovery, or distributed scheduling.
• No batch_id in YAML, data, claims, identities, contexts, events, or scheduling metadata.