feat(federation): ship v0.29.0 federation

[tcballard]

Summary

This is the single integration PR for the remaining v0.29.0 federation release. It combines the exact intended content from #459, #460, #461, #462, #470, #471, #472, and the original #469:

• verified source-aware federation across CLI, MCP, routing, enforcement, audit, and cache
• inherited viewer, documents, graph, and Portal projections with stable source identity
• opt-in federation setup guidance and end-to-end certification
• manifest-v2 multi-parent DAG verification, contextual resolution, override chains, closure generations, and store/v3
• graph engine activation, profile/evaluation certification, corpus status/explain observability, and a pinned multi-parent diamond example
• forge-neutral repository semantics, v0.29.0 metadata, changelog, documentation, and distribution contracts
• exact v1 and no-manifest compatibility

Consolidation integrity

• Base: post-feat(cache): persist verified federated generations #458 main at 28a5b03c6cbb5b3fb256e12dabab4dad9dbbd779
• Intended final tree: 356db8a02be944d6af8588c7d3168f58b2f06b2b
• Previous final head: b52edcbe9a5a19f8b0e6907c7ba62e4414f0e3af
• Replacement history: one signed commit, because this repository squash-merges PRs
• File content: byte-for-byte unchanged from the previously validated final tree

This supersedes the remaining stacked review edges. Fresh hosted CI must pass on the exact replacement head before merge.

Product boundary

Cursor Origin already stores ordinary Git repositories, so identical materialised bytes work without a core adapter. Future Origin-native review/check operations and an Omarchy-native corpus workbench remain optional integrations outside deterministic federation semantics. The MCP remains a read-only consumer.

Verification

The preserved final tree previously passed the complete release, Clippy, federation, observability, export, MCP, platform, documentation, packaging, and dogfood suites. This consolidated exact head must now pass both hosted PR Checks and rust-spike, with every reported check non-failing.

Closes #267
Closes #270
Closes #271
Closes #272

Do not tag or publish v0.29.0 until this exact head is merged and the release is separately authorized.