refactor: extract semantic model boundary

[luca-ctx]

Summary

• Extract model identity, acquisition, cache, E5 text policy, runtime selection, and embedding into ctx-semantic-model.
• Keep ambient path/env resolution and index/daemon scheduling in ctx composition.
• Keep one model authority: ctx -> ctx-history-index -> ctx-semantic-model -> ctx-history-core, with no reverse edge.
• Preserve the exact 424-byte persisted semantic policy plus frozen model descriptor and E5 prefix goldens.
• Keep S1+C1 as one atomic commit; this does not include C2 or G0.

Base: f116170aba830f6ea66b6478c5b04684eef21e20 (PRs #313 and #314 included).

Approved source commits:

• c85ede52d096c5b4ae8160d50fc2abe3ebbd1d4a (patch 8843f4ec8120e10372b7c12a05998982010fe85e)
• bb1529a99b6cd3474038be3f4b9ced6472b7d5b5 (patch ba01dab4fa124c17f9c859f44c4e9c7ea24e6c70)
• eadc8ce0a789a727a29d81deffab887cc6224635 (patch 93af91beaf82b4de4b214dffa32bb6068f4402ef)
• Approved aggregate S1+C1 patch: 33ca291fda7fac11a22dc7e071df528bac0f0db4

Current-main adaptation: PR #313 added a transport-recovery test that named the former private semantic::model_runtime module. It now consumes SharedSemanticRuntime through the extracted semantic re-export. PR #313's JSONL terminal/progress behavior and PR #314's fixture-path hardening are otherwise retained unchanged.

Size and dependency evidence

Pinned scc 3.7.0 production Rust CLOC, using the Bazel production source set (including each build.rs and the explicit production include! source):

Tree/package	Files	CLOC	Delta from main ctx
origin/main ctx	343	124,116	—
Candidate ctx	327	115,999	−8,117 (−6.54%)
Candidate ctx-semantic-model	26	8,584	extracted crate
Candidate combined	353	124,583	+467

ctx-semantic-model is below the 20k production-CLOC ceiling. The claim is a material shrink of the central ctx crate, not a repository-wide line reduction; composition seams add 467 combined CLOC.

Cargo.lock adds exactly the workspace package ctx-semantic-model 0.26.0. All 487 third-party name/version/source/checksum tuples are unchanged. Cargo and Bazel boundary checks both enforce the acyclic graph.

Raw-output authority

One scanner/allowlist authority covers all ctx production output plus both build scripts. The build-script inventory is exact and fail-closed:

• crates/ctx-cli/build.rs: 6 Cargo directives (main#1@3d618d0d6e1305c1 through main#6@17e10d71b62c3756)
• crates/ctx-semantic-model/build.rs: 2 Cargo directives (main#1@0947514f54f72ef8, main#2@90a37aff9068bc84)

The gate asserts the 6 + 2 split and its self-tests reject additions, removals, stale entries, and reorderings. The old moved CLI waiver is absent.

Validation

Focused semantic/policy batch — 5/5 passed:

scripts/bazelw test \
  //crates/ctx-cli:raw_output_policy_tests \
  //crates/ctx-semantic-model:unit_tests \
  //crates/ctx-history-index:unit_tests \
  //:semantic_model_build_cfg_parity_check \
  //:semantic_model_dependency_boundary_check \
  --config=ci --test_output=errors

CLI/current-main convergence batch — 4/4 passed:

scripts/bazelw test \
  //crates/ctx-cli:unit_tests \
  //crates/ctx-cli:daemon_config_reload_tests \
  //crates/ctx-cli:search_show_tests \
  //:loc_check \
  --config=ci --test_output=errors

Release/route/inventory batch — 14/14 passed, including all six platform release-route analyses:

scripts/bazelw test \
  //:release_sbom_tests \
  //tools/bazel:release_route_analysis_tests \
  //:public_cli_bazel_release_contract \
  //:linux_bazel_release_controller_tests \
  //:native_bazel_packaging_contract_tests \
  //:buildkite_pipeline_check \
  //:rust_target_inventory_check \
  //:test_tier_inventory_check \
  --config=ci --test_output=errors

Final no-cache raw-output/format check — 2/2 passed:

scripts/bazelw test \
  //:rustfmt_check \
  //crates/ctx-cli:raw_output_policy_tests \
  --config=ci --nocache_test_results --test_output=errors

Full public merge gate — 121/121 passed:

scripts/bazelw test //:ci --config=ci --test_output=errors

Residual limitation

Validation ran on the Linux host. The macOS, Windows, and FreeBSD release routes passed configured analysis and packaging contracts, but their native binaries were not executed on those operating systems in this review-preparation run.