Capture immutable CLI startup defaults

[TheGreenCedar]

Context

PR #984 made endpoint/model/retrieval settings immutable per project, but
multi-project stdio still re-read the user home, project-network opt-in, stdio
cache root, and default cache root while switching projects. A changed process
environment could therefore move one request's SQLite or sidecar state and make
the two roots disagree.

The first CI run exposed the remaining split-root case: Linux stdio contracts
timed out when CODESTORY_STDIO_CACHE_ROOT=A and the project's explicit cache
root was B. The retained repair monitor wrote terminal state in A while
status, reconciliation, and broker reads reconstructed B and waited forever.

Closes #1015
Refs #912
Refs #884
Refs #897
Refs #899

What Changed

• Added one concrete immutable CliStartupConfig snapshot for user home,
  project-network trust, stdio/default cache roots, and sidecar runtime defaults.
• Threaded that snapshot through project config loading and multi-project stdio
  selection.
• Added an explicit in-cache sidecar constructor so latest-run discovery and
  sidecar layout use the captured sidecar base independently of an explicit
  project database cache override.
• Threaded the retained sidecar through repair status/results, lock arbitration,
  abandoned cleanup, stale-live detection, broker construction and persistence,
  GPU identity, and status-cache fingerprints.
• Strengthened the production boundary check against late project-selection
  environment/cache reads.
• Added a concurrent two-runtime regression over actual storage/state paths and
  trusted endpoints; retained the A/B/A endpoint/vector proof and added explicit
  A/B repair-state non-leakage and abandoned-cleanup coverage.

flowchart LR
    S["Process startup snapshot"] --> D["Project database cache"]
    S --> R["Retained stdio sidecar cache"]
    R --> O["Repair status, locks, results, broker"]

Loading

How To Review

1. Review CliStartupConfig in crates/codestory-cli/src/config.rs.
2. Follow RuntimeContext::new_with_startup into the explicit in-cache sidecar
   constructor.
3. Follow stdio_agent_sidecar_for_runtime through reconciliation, broker
   snapshots, repair monitoring, and status cache fingerprinting.
4. Review the concurrent runtime and explicit split-root regressions.

Verification

• cargo test -p codestory-cli runtime::tests::explicit_startup_snapshots_isolate_concurrent_runtime_paths_and_endpoints -- --exact --nocapture — passed
• cargo test -p codestory-cli --test stdio_protocol_contracts multi_project_stdio_startup_snapshot_keeps_embedding_endpoints_isolated_across_a_b_a -- --exact --nocapture — passed
• cargo test -p codestory-cli readiness_broker::tests::reconcile_before_enqueue_for_sidecar_keeps_abandoned_cleanup_in_retained_root -- --nocapture — passed
• Focused successful/failed terminal, active-repair, and stale-live stdio
  contracts — 4 passed
• cargo test -p codestory-cli --test stdio_protocol_contracts -- --nocapture
  — 51 passed, 0 failed, 9 ignored
• cargo test -p codestory-cli --test architecture_contracts — 12 passed
• cargo check -p codestory-cli — passed
• cargo clippy -p codestory-cli --all-targets -- -D warnings — passed
• cargo build --release -p codestory-cli — passed
• Runtime-config boundary, docs links, workflow policy, formatting, and diff
  checks — passed
• Independent post-fix source review — clean
• Required ignored repo e2e attempted exactly; no row was emitted. The drill
  case was blocked by missing CODESTORY_REAL_REPO_DRILL_CASES, and the release
  stats case was blocked by missing bge-base-en-v1.5.Q8_0.gguf /
  CODESTORY_EMBED_MODEL_DIR. The stats log was not changed.

Risk

The change affects CLI cache and repair-state selection when
CODESTORY_STDIO_CACHE_ROOT is set. Project database overrides remain separate;
all stdio sidecar coordination now intentionally follows the one retained
sidecar base. The first Linux CI run timed out on the split-root bug described
above; the amended head requires fresh Windows, Linux, and macOS proof. No UI
changed.