feat(index): add snapshot-bound multi-view query index

[2233admin]

Problem

#258 introduced the deep ProjectContext query seam, but the committed read path still has three structural limits:

• A08 v1 folds each repository to one lexically latest run, so consumers cannot model multiple admitted snapshots without rescanning the authority tree.
• artifact index --operation incremental validates the supplied index and then performs a full scan; it has no dependency-keyed view reuse.
• Query handlers repeatedly traverse the same verified Artifact Refs, while ProjectContext::Query exposes only one evidence-shaped intent.

Graft-style graph files are not the target. The target is a Pipeline-owned, evidence-native multi-view index whose projections remain subordinate to A07/A08 authority.

Decision

Add one crate-private deep Module behind ProjectContext and CommittedEvidenceController:

SnapshotCatalog::build(A08 authority) -> admitted snapshots
QueryIndex::materialize(snapshot, view) -> dependency-keyed immutable view
ProjectContext::query(QueryIntent) -> QueryAnswer

• A08 code-intel-artifact-index.v1 remains unchanged as the latest-by-repository compatibility/authority projection.
• SnapshotCatalog retains every fully validated completed repository.iteration and never admits staging, forged, non-completed, or mismatched publications.
• ViewKey = sha256(view version + snapshot identity + ordered source Artifact Ref schema/type/digest/consumedSnapshotIdentity + config digest).
• Committed evidence keys and current-working-tree freshness keys remain separate: a dirty checkout may change freshness without changing immutable committed views.
• Materialized views/cache are disposable hints. A cache hit never skips A07/A08/Artifact Ref verification and never becomes authority.
• Existing CLI and MCP wire schemas remain compatible in this slice; raw artifact query remains an administrative Adapter.

First vertical slice

1. Introduce typed SnapshotCatalog, QueryIntent, ViewKind, ViewKey, and an in-process QueryIndex cache in Rust; no new dependency or lib.rs.
2. Materialize at least two deterministic views over reverified committed evidence: an artifact catalog and a lexical content view.
3. Route the existing project evidence query through QueryIntent and the shared index while preserving its current domain JSON; the long-lived MCP process may reuse a view only when its dependency key is identical.
4. Preserve full A08 revalidation, repository binding, freshness reporting, newest-run selection, and all existing diagnostics.
5. Document the seam and the follow-on path to historical revspec selection and action-level CAS ([evidence-kernel] T6 fact plane v1:content-addressed 增量自扫(action cache) #51/invariant: 工具态可从任意 revspec 重建——index/pin/packet 跟随 git 态 #100) without enabling public-release promotion during the RC freeze.

Acceptance

• identical verified inputs produce byte-stable view keys and deterministic view bytes;
• changing any source Artifact Ref digest, consumed snapshot identity, view version, or config digest invalidates the affected view;
• changing only current checkout freshness does not mutate the committed view key;
• corrupted/missing cached state degrades to a rebuild and cannot change query authority;
• CLI and MCP continue to decode to the same domain document and existing public schemas remain green;
• forged/staging/non-completed publications remain excluded;
• focused tests, relevant integration contracts, hardcoded-path scan, and Sentrux session gate pass.

Non-goals

• A08 v2 or a database;
• cross-machine/distributed cache;
• mandatory tree-sitter/LSP/embedding/model runtime;
• caching Repowise/model-backed nondeterministic results;
• promoting advisory or reconstructed revspec views to committed/gate authority;
• public release promotion while DR-0006 remains active.

Refs #51 #100 #257

[2233admin]

Claimed by branch codex/issue-264-multiview-query-index. Approach: add a crate-private SnapshotCatalog + dependency-keyed QueryIndex behind ProjectContext, preserve A08 v1 and all authority checks, route the existing evidence intent through two deterministic views, and verify cache invalidation/CLI-MCP parity without new dependencies or public wire changes.