feat(federation): establish graph engine foundation

[tcballard]

Summary

Establish the graph-capable federation foundation authorized by ADR-144 through ADR-148.

This is the first implementation PR stacked on #462. It deliberately does not activate graph federation on public read, enforcement, MCP, or export paths yet.

• parse and verify version-2 federation manifests with multiple direct parents
• recursively verify bounded, offline source graphs, including cycles, diamonds, divergent pins, containment, and exact snapshots
• add the version-2 digest contract and decided corpus digest --version 2
• compose source-contextual graph visibility, qualification, equal-ID ambiguity, override chains, convergence, and historical/effective relationships
• define canonical closure generation v3
• isolate and validate graph stores under store/v3, including complete ordered mappings and terminal redirects
• preserve version-1 and no-manifest behavior

Stack

• Base: docs(federation): ratify graph-complete v0.29 scope #462
• This PR: graph loader, semantic composition, generation, and persistence foundation
• Later stacked PRs will activate the shared read model, cache/freshness, CLI/enforcement, MCP, exports, profile/evaluation, and full certification.

Please review after #462. Do not merge this PR independently of its base.

Validation

• cargo check --workspace
• targeted core/CLI clippy with -D warnings
• graph loader: 8/8
• graph composition: 12/12
• existing v1 composition: 9/9
• federation loader: 12/12
• corpus digest CLI: 3/3
• generation contract: 5/5
• graph store contract/corruption tests: 5/5
• existing workspace suites remained green at the foundation boundary
• git diff --check

No GitHub issue is closed by this foundation PR.