BuildJournal: one typed home for the run's working memory

[czpython]

Was stacked on #46; rebased onto main after it landed.

BuildWorkflow's replay-rebuilt working state sprawled as five parallel lists plus a watermark int, with its projections living as workflow methods and the replay contract existing as one comment. The pattern is sound (Temporal holds workflow state exactly this way); the sprawl and the invisible contract were the problems.

• New backend/druks/build/journal.py — build-local, deliberately NOT an SDK primitive: PlanRecord (a plan plus the reviews of that draft) and BuildJournal (plans, implementations, evaluations — the list _implementation_reviews misnamed — and human_feedback), with the replay contract stated on the class. Each add_* returns its argument so call sites chain around the agent call. PlanRecord nesting kills the _reviews_at_plan watermark: reviewer_requirements() is just the filtered reviews of plans[-1].
• The workflow keeps one attr, self._journal. Pure-diary wrappers (generate_plan, review_plan, revise_contract, evaluate) dissolve into their phase call sites; implement and triage_feedback keep their real control flow and only their diary writes move.
• BuildPromptContext diets to identity facts and carries the journal; templates read it directly (build.current_plan → build.journal.plan.plan_markdown, build.implementation_reviews → build.journal.evaluations, build.reviewer_requirements → build.journal.reviewer_requirements(), revision counters → build.journal.*_revision, the SHA pair → build.journal.last_implementation.base_sha/head_sha under one guard — the journal only ever holds successful deliveries, so the two per-field guards collapse). Safe because workspace. already passes a live object, StrictUndefined fails loudly on a renamed projection, and the ImmutableSandboxedEnvironment keeps templates structurally read-only.
• build.acceptance_criteria wasn't on the ticket's retire list but was context-fed from the plan; it migrates the same way (build.journal.plan.acceptance_criteria).
• Verified zero stale refs across templates/prompts/build/ for every retired name.

Same note as #46 for repo-level prompt overrides of _header.md: the build.<field> names above changed shape, and StrictUndefined fails loudly on a stale override.

ENG-726