feat(stokowski): add deterministic phase one core

[ruby-automation]

Resolves EXT-58.

Summary

• add provider-neutral deterministic domain values, immutable configuration snapshots, routing, validation, and checkout-independent fingerprints;
• implement the pure phase reducer with typed completion, approval, rework, escalation, failure, terminal cancellation, and stable effect identities;
• add the safe prompt subset, lifecycle/report contract, structured report projection, and dual-read/v1-write tracking codec;
• add the generic Continuum flow with fixed fake activities, replay coverage, package-owned default/specialized examples, and committed histories.

Verification

• mise exec -- mix format --check-formatted
• mise exec -- mix compile --warnings-as-errors
• mise exec -- mix test (58 stokowski, 17 repo_management)
• mise exec -- mix do --app stokowski escript.build
• ./fantasia version
• mise exec -- mix phase0.verify

Real provider, workspace, hook, and runner integrations remain outside this Phase 1 slice and are left for the adapter/orchestration phases.

[ruby-automation]

Rework completed for the review findings:

• fixed report rendering for non-empty next_steps, map-valued scalar fields, and missing artifact captions; added fenced-JSON fallback coverage;
• enforced workflow-directory prompt containment, including relative traversal paths;
• made fingerprints independent of explicit-vs-routed selection provenance and preserved declaration order without leaking loader metadata into graphs;
• retained atom-keyed event payloads and added the missing :escalate shorthand;
• narrowed Continuum trust to the audited deterministic helper, tracked rework budgets per gate (including max_rework: 0), and allowed the signal loop to continue after rework;
• kept multibyte prompt truncation valid UTF-8, filtered no-space machine markers, and preserved arbitrary legacy gate statuses;
• added the committed-history generator and provenance README;
• recorded the Ash domain/resource/action layer as an explicit Phase 1 deferral in ADR 0007 because this slice has no persistent/queryable operational domain.

Verification passed locally:

• mise exec -- mix format --check-formatted
• mise exec -- mix compile --warnings-as-errors
• mise exec -- mix test — 71 stokowski and 17 repo_management tests
• mise exec -- mix phase0.verify
• mise exec -- mix do --app stokowski escript.build and ./fantasia version
• mise exec -- mix stokowski --dry-run
• mise exec -- mix phase1.histories

The changes are in signed commit dea28e1.