#767 feat(sdk): make project context integrity explicit

Outcome

This broad SDK/CLI bundle turns context integrity into explicit, machine-readable contracts across five related failure surfaces:

• certifies list corpora as complete, partial, or unchecked and adds strict fail-closed reads across CLI, SDK, and tool schemas;
• records dependency author provenance and mutation source consistently;
• quarantines malformed extension commands without losing healthy siblings or suggesting reinstall of an installed package;
• constrains recovery inference to the invoked command contract and emits valid strict-close recovery;
• fixes merge receipt path quoting and refreshes merge fences for every runtime item type.

It also updates generated contracts, the public SDK surface, token budgets, documentation, the package-generated changelog, PM histories, and focused regressions.

PM lineage

• pm-57ir3b — truthful list completeness and strict reads
• pm-0a24f5 — dependency provenance
• pm-ikv6m0 — contract-scoped recovery
• pm-gnowgi — per-command extension quarantine
• pm-9nfpwd — merge receipt path safety

Verification

• 377 test files / 6,452 tests
• 100% statements, branches, functions, and lines (44,548 / 31,650 / 9,116 / 43,281)
• static quality and 100% docstring gates
• SDK surface, entrypoint-cost, CLI transport, token-budget, docs/skills, package-boundary, version-sync, and secret gates
• packed npm smoke and 88-command package-first dogfood
• fresh unrelated packed consumer through direct binary, npx, and bunx with strict completeness and dependency-provenance assertions
• PM validation: zero history drift and zero in-progress items

Closes #752
Closes #755
Closes #757
Closes #763
Closes #764

---

Summary by cubic

Make context integrity explicit across the SDK and CLI. Adds truthful list completeness with strict reads, preserves dependency provenance, isolates bad extension commands, tightens recovery hints, fixes merge receipt quoting, and keeps committed merge fences extension‑independent.

• New Features

  • List completeness: results include completeness with unreadable counts; add --strict-read to fail closed in pm list* and SDK/MCP tool contracts.
  • Dependency provenance: dependency writes set author, author_source, and source_kind (defaults to detected author and CLI source); persisted and rendered in items.
  • Extension isolation: malformed definition-based commands are quarantined per-command; valid siblings still activate; unknown-command recovery surfaces the failure without reinstall advice.
  • Structured recovery: missing-flag and retry hints are derived from the invoked command’s contract only; close --validate-close strict emits a concrete retry when required fields are missing.

• Bug Fixes

  • List truthfulness: fixes cases where unreadable items were silently dropped while reporting complete results.
  • Merge safety: driver config now passes %P without extra quotes and receipts strip one legacy quote pair; committed fences are extension‑independent (extension-owned types stay clone‑local).
  • Guidance hygiene: suppress “install ” hints when the matching installed extension failed activation; stop mining free-form error prose for flag names.