Rebuild for plans-as-code (embedded TS evaluation) - #1

Reorient the whole tool around evaluation (decisions 0012/0014):
- model: a Version is recovered by evaluating a module; identity is the sha256
  of source bytes; keep validate (cycle/dup/dep), changes_nothing, filenames.
- catalog: admission is byte-hash + filename check, no evaluation; parents are
  derived from import specifiers; source stored unchanged at 0444; evaluate()
  runs the module on demand.
- chain: head/divergence/orphan now walk import-derived parents.
- readiness: computed from an evaluated Version + events (per-head labelling
  moved to the CLI).
- predicate: add decision-0013 self-contradiction detection (refused at commit)
  and the write-time evidence cross-check (reported, never refused).
- CLI: start/commit/show/history/ready/status/verify/repair/progress/evidence/
  version, each with --json parity and a convergence line; reads render
  not-found/unresolved/stopped distinctly.
- refs: trimmed to event-id minting (plan/step identity is no longer minted).
- drop change.rs (structural-diff rendering) and the KDL @block use for versions.

Full e2e verified by hand: start -> edit -> commit -> show/history -> revise ->
divergence -> reconcile -> converged, all steps carried forward. 129 lib tests
pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…and VRS add-step defect

- tests/acceptance.rs: examples evaluate + filenames reproduce from source
  bytes; reconciliation carries both sides; full e2e lifecycle through the CLI
  (start -> commit -> show/history/ready -> revise -> diverge -> reconcile);
  and engine failure-mode guards (unresolved / stopped / sandbox: no eval, Date,
  Math.random).
- eval.rs: a missing imported predecessor now reads as Unresolved (wait), not a
  generic Failed — resolution succeeds so the loader reports the absent file.
  Drop the unused ctx threading through extract/to_pred.
- cmd.rs: the changes-nothing refusal is a plain string, not format!.
- context/06-api/spec.md: the 'A revision' example added a Step anonymously,
  which has no identity (decision 0012) — same defect the example plans had.
  Added steps are now named exports, so spec, prelude, and examples agree.
- example READMEs: point at the corrected version filenames.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- examples/README.md: the examples are evaluated (they are the acceptance
  suite), no longer 'not yet evaluated'.
- 02-artifacts DELTA-001: a distinct `repair` command now exists (refuses on a
  clean catalog, names the last intact predecessor); narrowed from open, with
  the remaining gap (author vs scaffold) recorded.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The acceptance suite reads the committed example plans as fixtures, but the
fileset excluded examples/, so the tests passed locally (examples present in
the worktree) and failed under nix build (examples stripped from the sandbox
source). Only nix build catches this. Adding examples/ to the fileset.

A nix build output symlink whose blob content is a /nix/store path — not
something to carry in a public repo, and it churns on every build. Untrack
it and gitignore it.

Commit resolved every imported version-file against the current plan's store
and required each to be a committed predecessor, so a cross-plan reference
(`../../pl_other/versions/...`) failed to resolve and the module was wrongly
rejected as having an uncommitted predecessor — leaving the documented
cross-plan Step reference (CMP.API-R05) unusable.

An import is now a predecessor only when it is a version of the same plan; an
import of another plan's version is a cross-plan reference, resolved against
that other plan's store and required to be admitted there, but never made a
parent of the current version. Catalog admission applies the same rule when
deriving lineage, so a cross-plan reference no longer appears as an orphan
predecessor edge. Both paths classify through the shared import_target_plan.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

When two reconciliation sides defined the same named Step with different
content, reconcile silently kept the first side and dropped the other — the
silent intent loss the whole reconciliation design exists to prevent.

Reconcile now detects when sides disagree on a same-identity Step (comparing
work, dependencies, acceptance, supersedes, and retirement) and refuses the
reconciliation unless it carries an explicit `edit` for that Step stating the
surviving intent. The error names the Step and both differing sides. A Step
only one side carries, or that both sides left identical, is not a conflict and
is carried forward unchanged. Resolves DQ08 in favour of never asserting intent
nobody wrote.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- imports_are_restricted_to_legitimate_modules: an absolute or catalog-escaping
  import is refused at eval; a valid same-plan sibling resolves.
- a_cross_plan_reference_is_not_a_predecessor: a cross-plan reference commits
  successfully, records no parent, and does not read as an orphan.
- reconciliation_refuses_divergent_same_step_without_an_explicit_edit: a
  divergent same-step reconcile is refused naming the step; an explicit edit
  resolves it; a non-conflicting reconcile still works.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- decision 0016: a divergent same-Step reconciliation edit must be resolved
  explicitly (resolves DQ08), matching the never-silently-lose-intent principle.
- 06-api: the documented cross-plan dependsOn edge is not usable — validate()
  checks deps against the version's own steps and readiness folds within one
  plan. Narrowed CMP.API-R05 to the reference (which works), deferred the
  dependency edge to DQ11, and fixed the import path depth (../../, not ../).
- 05-integrations: refined CMP.INT-R06 — the substrate cannot express
  completeness any more than the catalog can, so convergence is at most
  'quiescent as of now', never 'you have everything'.
- DQ12: variable-in-content vs relative-import+env-root machine-agnosticism.
- fix the repair delta to the enforced shape (status open, bare direction).