Add projection envelopes to global todos and risks

[maxliux5]

Summary

• Seal typed projection envelopes for global-todos and global-risks through the existing TypeScript kernel.
• Disclose source health, global membership gaps, scan omissions, and display truncation in JSON and Markdown.
• Update the projection contract and migration status.

Validation

• 93 focused Python tests passed, including real CLI membership failure/recovery.
• Ruff and Python compile checks passed.
• Control-plane TypeScript typecheck passed.
• Public/private boundary scan found no newly added local paths, secrets, or private state.