Harden indexing lifecycle, freshness, and T100 extraction

[jordannn02]

Summary

• add a source-owned executable capability contract exposed through --version, --manifest, and MCP tools/list
• make repository indexing observable, cancellable, and backgrounded by default with job IDs and progress state
• persist source/extractor freshness metadata and expose ready, stale_source, stale_extractor, missing_root, and partial states
• add dry-run-only index pruning and preserve corrupt index evidence instead of deleting it implicitly
• add T100/TIPTOP 4GL-family discovery and extraction support with regression coverage

Why

The executable, plugin metadata, and actual MCP tool surface could diverge without a runtime-owned contract. Long-running indexing also lacked a durable job lifecycle, and an index could appear ready even after its source root or extractor changed. T100/TIPTOP .4gl, .per, .42m, and .sch sources additionally needed explicit language and extraction support.

Impact

• callers can verify the exact executable version, commit, build ID, checksum, tool list, and UI capability
• indexing can be polled and cancelled without terminating the MCP server
• stale or incomplete indexes are distinguishable from usable indexes
• cleanup decisions are previewable and non-destructive
• T100/TIPTOP source tracing gains functions, calls, table reads/writes, and language discovery coverage

Validation

• fresh ASan/UBSan full test suite: 5638 passed, with no sanitizer markers
• fresh production build with -Wall -Wextra -Werror
• manifest assertions: schema 1, 17 tools, ui_assets=false, cancel_index and prune_index present, repo_map absent
• source and installed plugin contract smoke tests passed against the sealed executable
• git diff --check passed and the published worktree was clean

Commits

• 4db7262 - implementation and regression coverage
• 6559c16 - clean-build provenance