Harden Forge schema boundaries

[im-sham]

Summary

• centralize Proofhouse structured-axis metadata for Forge-owned incident fields
• add CLI/MCP structured-axis filtering, SubjectRef pointer support, and schema visibility
• reject obvious raw/sensitive payload keys in pointer refs and observed_state
• tighten incident store duplicate-id and ambiguous suffix behavior

Tests

• .venv/bin/ruff check forge_cli/ tests/
• .venv/bin/pytest tests/ -q -p no:cacheprovider
• git diff --check