Always mint a repo prefix; remove single-repo mode

[zzet]

Fixes #375, Fixes #393, Fixes #309

Why

Gortex had two indexing modes producing two ID schemes for one graph. A workspace's only repo was indexed without a prefix — nodes carried an empty RepoPrefix and raw repo-relative ids (internal/foo.go::Bar) — while any workspace with two or more repos prefixed everything.

The mechanism was small: four places choosing not to call SetRepoPrefix. The cost was not. It bought a re-mint migration for when a second repo joined, an Unprefixed provenance flag threaded through eviction and scoping, whole-graph scan fallbacks where a byRepo bucket lookup would do, ~130 lines of reconstruction in daemon status, and per-repo counters that skipped the lone repo entirely — the root cause of the near-empty status row in #261/#270.

This makes prefixing unconditional. A lone repo is simply the first tracked repo, so one ID scheme covers the graph at every workspace size. Repo count still decides IsMultiRepo() and whether an unqualified path is ambiguous; it no longer decides ID shape.

The hard part is that every failure mode here is silent

None of these produce an error — they produce a subset, or a duplicate, while index_health stays green. So the first commit ships the detection, against unchanged behaviour, before anything moves:

• graph.ClassifyNodePrefix / PrefixDiagnostics partition file-backed nodes into owned / unowned / misprefixed. store_sqlite answers the same audit with aggregate SQL, and a storetest conformance case fences the two backends — a divergence there would make the detector report clean on exactly the backend the daemon runs.
• index_health gains a repo_ownership block; the daemon logs the audit after warmup (Error with named samples when dirty).
• priorMtimesFromStore warns when a repo has no mtimes but the store holds them under other prefixes — a prefix-keying mismatch forcing a cold re-index (and a paid re-embed), previously reported identically to a first index.
• surface_memories explains an empty anchored result by probing whether stored anchors still name live nodes.

That fence immediately caught a live bug on main: crossRepoRerank counted the empty prefix as a repository, so a result set mixing one repo's hits with synthetic global externals looked multi-repo, renumbered, and promoted the top external:: stub to rank 0 beside the top first-party hit. Fixed in the same commit.

Upgrade path

Schema v7 purges the on-disk residue. A pre-change store holds a solo repo's nodes under an empty prefix that nothing can reach — PurgeRepo refuses it, OrphanRepoPrefixes exempts it — so the first post-upgrade warmup would write a prefixed copy beside them and serve the graph twice, green. The step is in-place rather than rebuild: true because planSchemaMigrationWith reads that flag statically, and every multi-repo workspace would otherwise eat a full cold index for a change that cannot affect it.

Synthetic global externals survive: they carry no file path, which is exactly what the predicate keys on.

Stored note/memory anchors are migrated too (SidecarStore.PrefixSymbolIDs, marked once per repo). Surfacing matches ids by string equality, so the shape change would have severed every anchor at once and returned Total: 0 — indistinguishable from "nothing relevant". The rewriter is deliberately conservative: an id that still resolves is never touched, exactly one tracked prefix must produce a live node, and anything else is left as stored.

Verified against a real pre-change store (indexed with origin/main, opened with this branch):

user_version: 6 → 7
UNPREFIXED code nodes:  8 → 0
owned code nodes:       0 → 8
MISPREFIXED:            0
total nodes:           10 → 12   (not doubled)
file_mtimes prefixes:  [''] → ['repo']
ids: repo/main.go::Hello, repo/pkg/lib.go::T.M, …

Then on restart: priorMtimesFromStore loaded prefix=repo count=2, reconciled repo from snapshot, repo ownership audit clean owned=8 unowned=0 misprefixed=0. One cold index on upgrade, warm thereafter.

Two plan items that turned out to be wrong

The audit assumed the remaining repoPrefix == "" branches in the graph layer were dead. They are not — the standalone Indexer (indexer.New with no SetRepoPrefix) still mints unprefixed nodes by design, and it backs gortex init, the eval harnesses, bench, pkg/gortex's public API and serverstack's embedded indexer. Only MultiIndexer was changed. GetRepoNodes("") and friends are that indexer's own repo; deleting them would have silently blinded every standalone caller. Same for scopedSpringConfigKeyID's unscoped branch. Both became fences and doc corrections instead of deletions.

Compatibility

• Bare repo-relative paths keep working in a solo workspace, including for files that don't exist yet (write_file create targets) — existence-gated anchoring alone could not resolve those.
• resolveFilePath now returns relPath in the graph's spelling. Echoing the caller's bare input back resolved the bytes and then reported file_not_indexed for a file that was indexed; that bug is fixed here.
• Removing UntrackRepo's EvictFile loop also fixes a sidecar leak: that branch sat above the PurgeRepo capability probe, so a solo untrack skipped the sidecar-aware purge and leaked fifteen tables every cycle.

Known residue

A pre-change solo store keeps a handful of bare stdlib:: / module:: stub nodes alongside the freshly minted <repo>::-scoped ones (2 in the rehearsal above). They are in the global class — same symbol, both resolvable, visible from every repo — so they are duplicates rather than wrong answers. v7 does not purge them because a bare module:: is legitimately global for non-Go languages and the two are not distinguishable by id shape alone.

Testing

Full suite green (go test ./... and go test -race ./...). bench/index-perf's wall-clock gate flakes under full-suite contention and passes 3/3 in isolation; it builds a bare indexer.New and is untouched by this change.

New fences, each targeting a specific silent failure:

test	catches
TestRepoPrefixParityAfterIndexing	stamped prefix disagreeing with id/path, at one repo and at three
storetest PrefixDiagnostics	the two backends' audits drifting apart
TestOpenV6PurgesUnprefixedSoloRepoRows	the ghost graph, and global externals being purged with it
TestStandaloneIndexerKeepsTheEmptyPrefix	deleting the standalone Indexer's live empty-prefix reads
TestEmptyPrefixIs{Wildcard,Exact}*	collapsing a wildcard "" into an exact match
TestRepoNarrowPredicatesAgree	one scoping predicate rejecting what another admits
TestCrossRepoRerankSoloWorkspaceIsNoOp	the empty prefix counting as a second repo
TestCommunitySignal*	the same-repo boost flattening a single-repo batch
TestMigrateSymbolAnchors*	anchors silently ceasing to match, and over-eager rewriting of user data
TestResolveFilePath_LoneRepoBareRelative	bare-path read and create on a solo daemon