feat: add grounded agent graph overlays

[forhappy]

Summary

• add a dedicated compass-agent-graph domain crate for immutable agent-authored Assertions, Challenges, Retractions, deterministic Grounding verification, CAS publication, audit, GC, and exact rebase
• compose pinned Base Generations and Overlay Revisions into Effective Graphs used by query, history, task context, export, and the shared viewer
• expose complete local CLI CRUD/query/export workflows and opt-in MCP read/write tools with canonical project scoping and distinct HTTP write authorization
• document the versioned contracts, security model, compatibility boundary, phased design, and end-to-end integration workflow

Contract decisions

• GROUNDED is citation verification, orthogonal to structural EXTRACTED/INFERRED confidence
• Base Graph artifacts and published historical realizations remain immutable
• writes are deny-by-default; curated masks require separate authority
• every effective read names an exact Base Generation, Overlay Revision, and composition profile

Verification

• CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-grounded-agent-graph ./scripts/qualify_agent_graph_overlay.sh --fixtures-only
• cargo check -p compass-cli -p compass-mcp
• cargo clippy -p compass-agent-graph --all-targets --locked -- -D warnings
• cargo fmt --all -- --check
• npm run typecheck:js
• npm run test:js (210 viewer, 141 VS Code, 88 browser tests)
• node scripts/check_viewer_assets.mjs
• sh scripts/check_product_boundary.sh
• python3 scripts/check_compassql_support.py
• git diff --check

Verification notes

A broader changed-crate --all-targets Clippy run reached the pre-existing clippy::items_after_test_module failure in crates/compass-files/src/cache.rs. The normal lib/bin retry was later interrupted by No space left on device on the mounted Cargo target volume after the full Agent Graph qualification had passed. The Agent Graph crate itself passed all-target Clippy, and the affected CLI/MCP crates compiled cleanly.