EXP-0147: project expansion coverage

[buger]

Stacked on EXP-0132 (#589).

Adds an opt-in expansion coverage contract and deterministic request-bound live/replay projection over existing Graph v2 lifecycle facts. The exact denominator is derived from validated ClaimProjection catalog evidence, while InstanceProjection supplies the per-item lifecycle evidence. Replay rebuilds both projections before projecting coverage.

Provider outcomes are limited to clean, findings, or guardrail; the host derives error from execution failure and cancelled only from an exact managed-deadline/cancellation evidence bundle. Invalid or incomplete lineage fails closed. Semantic digests exclude request IDs and provenance, so equivalent executions remain stable across sessions and completion order.

Public engine/journal APIs expose live projection, request IDs with an optional owner filter, and replay. Normal-path tests run through executeGroupedChecks with deterministic restored fakes, real throws, a real managed deadline, order inversion, empty catalogs, and in-flight state; direct journal injection is restricted to malformed-evidence cases.

Validation:

• focused Jest: 7/7 passed
• TypeScript baseline-relative: only the four pinned mcp-server.ts diagnostics at lines 931 and 947; zero candidate-path diagnostics
• caps: 343 production nonblank lines; 284 test+fixture nonblank lines
• scope: exactly the eight authorized paths

Nonclaims: no Proof/Probe/model/network/provider integration, admission, freshness, persistence, retry, lease, or global fan-in.