feat(core): graph storage, schema versioning, scan provenance

[officialCodeWork]

Summary

TRACKER Step 0.3 — the graph becomes a durable, versioned artifact. This is the foundation for pre-built graphs served to the pipeline (G2), SHA-keyed graph stores (G3), and staleness warnings (D1).

What's in it

• saveGraph / loadGraph in core — persistence with schema-version checking. A graph written by a newer CodeRadar refuses to load in an older library with an explicit "upgrade @coderadar/core" error, instead of being silently misread. Older versions load (migration hooks live here when v3 exists).
• collectGraphMeta — commit SHA + dirty-tree flag captured at scan time and embedded in the graph. coderadar scan now prints it:

  Scanned .../examples/demo-app/src
    commit: 9a075fc… (dirty working tree)
  

• schemas/lineage-graph.schema.json — the whole graph schema generated from the TS types via ts-json-schema-generator, committed, and drift-gated: a core test regenerates and diffs, so the committed schema can never lag the types. Regenerate with pnpm schemas. (Placed at repo root rather than TRACKER's original dist/ since dist is gitignored — TRACKER updated.)
• CLI find/trace load graphs through the validating loader.

Acceptance criteria (from TRACKER 0.3)

• Round-trip test: save → load → deep-equal
• Schema drift test
• coderadar scan output includes SHA (+ dirty flag)
• Version rejection verified end to end (v99 graph → loud failure, exit 1)

Test plan

• 24 unit tests green (6 new: round-trip, future-version rejection, junk-file rejection, SHA in/outside git repos, drift gate)
• pnpm eval gate OK — 25 pass / 0 fail / 2 xfail / 0 unexpected-pass

Documentation

• TRACKER.md — 0.3 done, Status → 0.4, schema location corrected

🤖 Generated with Claude Code