PR #983 - unbraind/pm-cli

Summary

This broad SDK and CLI tranche makes project-management context evidence authoritative, semantic, reversible, and stable under real agent workloads.

evaluate assurance against full authoritative metadata, add explicit present/missing predicates, canonicalize dependency kinds, fingerprint definitions, and preserve detected author provenance
make graph governance measure semantic context density, decode durable cache snapshots defensively, and reject incoherent cached evidence
expose truthful health ok values while treating immutable legacy provenance violations as visible advisory findings instead of permanently blocking otherwise healthy workspaces
make history-drift repair bypass stale metadata/body/collection caches and prove authoritative rereads after cached projections are poisoned
return role-labelled, shell-safe annotation recovery; partition generated error contracts; and keep contract snapshots/public SDK surfaces synchronized
make linked-test removal delimiter-safe, index-addressable, observable, and fail-closed across CLI, SDK, MCP, contracts, and completion
stabilize SDK entrypoint import-cost admission on the median of five fresh-process measurements while retaining p95 diagnostics and strict maximum-RSS budgets
upgrade and verify pm-changelog 2026.8.12 through companion PR #138 and its published npm/GitHub release

pm-py7qv2 — truthful assurance metadata and definition fingerprints
pm-33mjrw — detected assurance author provenance
pm-q6n8sj — canonical graph composition and semantic share
pm-h97qxd — health row ok parity
pm-rncuf7 — typed annotation transposition recovery
pm-m0b7h8 — lossless linked-test removal
pm-wqhzhg — exact-head review hardening and executable contract regressions
pm-eax4y8 — authoritative history-drift source scanning
pm-5q8wa0 — safe legacy provenance health disposition
pm-cg1sjb — deterministic SDK entrypoint import-cost admission
pm-c6urop — discovered compound linked-resource mutation UX follow-up; intentionally open and unclaimed

486 test files and 7,242 tests passed with exact 100% statements, branches, functions, and lines
pnpm lint, typecheck, contracts, changelog check, secret scan, production audit, graph assurance, record integrity, and SDK entrypoint cost gates passed
100% static docstring coverage and zero duplicated blocks
package artifact validation, 88-command package-first dogfood, packed npx smoke, and independent npm/Bun consumer acceptance passed
fresh temporary npm and Bun consumers exercised init, create, hierarchy, semantic dependency, claim, update, comment, evidence, get, close, and release through npx and bunx
pm validate --check-history-drift reports zero drift and pm health --check-only reports all ten checks healthy
semantic dogfood was explicitly skipped because PM_DOGFOOD_SEMANTIC was unset and is not counted as acceptance

Closes #979
Closes #980
Closes #982