feat: first-class goals — review-gated in-flight objectives

[dripsmvcp]

Summary

vouch models claims, pages, entities and relations — everything the project knows. it has no representation of what the project is trying to do right now, so an agent re-orienting after a compaction recovers facts and decisions but not in-flight intent. this adds goal as a first-class, review-gated artifact.

What lands

• Goal + GoalStatus (open / done / abandoned / blocked) in models.py, with the validation gap: Claim.text, Page.title, Entity.name accept empty/whitespace at the model layer; only propose_* enforces non-empty #155 empty-title validator on the model itself so every write path is closed at once.
• GOAL added to ProposalKind; kb.propose_goal routes through proposals.propose_* like any other proposal — there is no direct-write entry point.
• kb.list_goals (defaults to open, oldest-first, viewer-scoped) and kb.set_goal_status, backed by lifecycle.set_goal_status.
• open goals resurface in vouch digest and in the SessionStart recall digest.
• storage.py gains goals/ and pure put/get/update/list — no business logic; the status rules live in lifecycle.py and proposals.py.

How the review gate is preserved

two invariants, both tested:

approval is pinned to open. _payload_block_reason refuses a GOAL proposal whose payload carries any other status. approving one would put a transition on disk that never passed the lifecycle path and so never reached the audit log — a parallel write path in disguise.

lifecycle.set_goal_status is the only mutation path. it appends a goal.status event to audit.log.jsonl and a row to the goal's own append-only history. test_only_lifecycle_mutates_a_stored_goal scans the package and asserts no second caller of store.update_goal exists.

One deviation from the issue, called out

the issue's acceptance criteria ask for a decided/ record per transition. decided/ holds decided Proposal yaml keyed by proposal id and is read back through list_proposals; writing a non-proposal there would corrupt that read. the transition record instead lands in the two places that already carry authoritative history — the append-only audit log, and the goal's own history list, which is diffable in PRs exactly like decided/ is. happy to change shape if you'd rather transitions be proposals themselves.

Test Plan

• regression/feature tests added: tests/test_goals.py (18 tests) — propose→approve→transition, the propose-only invariant, the pinned-open refusal, unknown/no-op status refusal, oldest-first viewer-scoped listing, both digest surfaces, and four-site registration
• test_capabilities parity (_CLI_MIRRORS entries added) and test_hot_memory_universal_coverage both green
• full CI gate run locally

$ .venv/bin/python -m pytest tests/ --ignore=tests/embeddings -p no:warnings
2646 passed, 1 skipped in 160.25s (0:02:40)

$ .venv/bin/python -m mypy src
Success: no issues found in 119 source files

$ .venv/bin/python -m ruff check src tests
All checks passed!

Closes #427

[plind-junior]

I was missing this feature while comparing vouch with ditto