feat: add controller preview foundation

[rlippmann]

What changed

• Added a new stateless controller module above the engine:
  • step(engine, user_input) -> StepResult
  • preview(engine, user_input) -> PreviewResult
  • state_diff(before, after) -> StructuralDiff
• Implemented checkpoint-based preview orchestration only:
  1. export checkpoint
  2. run engine.step(...)
  3. capture decision/state/diff
  4. restore checkpoint in finally
  5. fail preview if restore fails
• Added controller result/diff typed contracts and exported controller APIs/types from package root.
• Added focused controller tests covering:
  • contract shape stability (output_version, mode, required keys)
  • non-mutation guarantees
  • clarify/pending behavior
  • idempotent/no-op behavior
  • restore-failure behavior
  • pending confirmation user-flow narrative (yes/no preview then real confirmation)
• Added small Python-local controller fixtures under tests/fixtures/controller/ for preview behavior checks.

Part of #84

Why

• Establish the 0.7 controller/preview foundation while preserving engine authority and structural contracts.
• Provide deterministic, inspectable dry-run behavior without adding a second semantic layer.
• Keep host-facing orchestration logic minimal and stateless.

Checklist

• pre-commit run (uv run pre-commit run --all-files)
• tests pass (uv run pytest)