Add bounded shared-search observability

[chaoz23]

Why

Long shared-search runs currently expose a final retained-memory high water mark, but not a bounded history of what the engine retained or which kinds of author-relevant evidence each interval produced. That makes long-run diagnosis and later deterministic policy work guesswork.

This is a deliberately partial implementation of #216. Phase 0 corrective PR #222 and the bounded checkpoint prerequisite in #223 are merged, and this draft is restacked directly on current main. It adds an observation ledger; it does not activate an allocation or stopping policy.

What changed

• adds versioned ResourceSampleV1 samples at a deterministic transition cadence and termination
• separates deterministic logical retained-owner estimates from observational process heap/RSS/external-memory readings
• reports current and peak pending/active state payload, variables, ancestry, exact dedupe, semantic indexes, frontier references, findings, retained nodes, released nodes, and compaction counts
• records a yield vector for runtime/assertion findings, approved goals/stages, authored knots, visible outcomes, meaningful variable transitions, exact terminal variants, and raw state territory
• distinguishes the first useful/critical boundary from yield after the first useful discovery
• keeps the retained sample history bounded and records compaction/incomplete-history state across checkpoints
• validates resumed ledgers fail-closed: exact cadence/count/cursor state, deltas, byte totals, peak/counter monotonicity, milestone relationships, and current checkpoint counters must agree
• carries an explicit run-wide state for monotonic additive-goal CLI progress while leaving nested samples pass-local
• exposes bounded numeric telemetry through progress, reports, and compact machine output; compact output reconstructs an exact-key recursive projection rather than forwarding nested objects
• samples process memory freshly while constructing JSON-stream run_end, independent of stderr progress mode, while carrying forward only deterministic logical-accounting bytes for comparison
• corrects assertion/goal/outcome discovery-event ordering without changing the live scheduler or result policy
• strips the shared-only callback before concurrent worker cloning

Process memory remains live observational data and is excluded from deterministic checkpoint/search identity.

Deliberate partial scope

Issue #216 remains open; this PR covers only the bounded observation-ledger slice. It defers:

• checkpoint-, pressure-, and discovery-triggered samples
• complete ownership for checkpoint/finalization buffers and all transient combined peaks
• campaign-new versus rediscovered yield
• transition throughput and retained-GiB-minute metrics
• the complete structured-stop contract
• per-owner budgets, pressure actions, adaptive windows, resumable epochs, or any live allocation/stopping policy

Verification

• current-main restacked full suite: 328 total, 325 passed, 0 failed, 3 expected sandbox/socket skips
• fresh install from the current main lock reported 0 vulnerabilities
• all 10 fresh hosted push/PR checks passed at c4b584f in runs 32547578316 and 32547581083
• focused compact-machine tests: 9 passed, including adversarial nested-secret and oversized-future-field input
• focused shared search/checkpoint tests: 28 passed, including impossible-ledger tamper rejection and legacy checkpoint compatibility
• focused run-wide resource tests: 2 passed for direct and CLI additive shared/portfolio goal work
• focused concurrent/Phase0 tests: 28 passed, including callback structured-clone safety
• TypeScript build and diff checks passed at exact restacked head c4b584f on current main f5b051c
• a 120-cell differential across ten fixtures, three budgets, two seeds, and production/replay modes found zero normalized-result, schedule, or policy-ledger mismatches; corrected discovery timestamps changed as intended
• independent adversarial re-review and integration review found no remaining merge-readiness blocker; the restack preserved the reviewed 17-file scope, exact 1,655-addition/22-deletion count, and identical ordered changed-line stream after the checkpoint merge changed nearby hunk context
• pre-restack calibration against the then-shipped CLI passed the narrow ≤5% median overhead gate: the eight-pair instrumentation run detected no increase; a fresh-build two-pair reviewed-head confirmation measured +0.65% median wall and +3.65% median peak RSS. One +8.06% RSS pair is disclosed as noisy short-confirmation evidence; the other was −0.82%. The current-main restack was not rebenchmarked, and this is not marathon or general promotion evidence.

Related: #215, #216.