Migrate broker and repair ownership to project identity v3

[TheGreenCedar]

Context

Broker and repair ownership still used project identity v2 and universally case-folded path text after lossless identity v3 landed in #974. That allowed case-distinct Unix roots to collide and left scopes, locks, snapshots, operation IDs, and GPU proof binding on the legacy contract.

Closes #1033
Refs #1032
Refs #913
Refs #899

What Changed

• Migrated broker scopes, snapshots, operation IDs, machine locks, and GPU runtime binding to ProjectIdentityV3 and lossless workspace IDs.
• Added fail-closed v1/v2 provenance mapping. Legacy snapshots remain read-only at their old path; verified state can inform observation, while refresh publishes only to the v3 path.
• Replaced duplicate refresh, repair, stdio, and native-lease path case-folding with the shared filesystem-aware comparator.
• Added v1/v2 migration, A/B/A isolation, non-default-port, Unix case-sensitive, Windows alias, lock, snapshot, and GPU-binding coverage.
• Documented schema-3 behavior and added the unreleased changelog entry.

How To Review

1. Review readiness_broker/scope.rs for current/v2/v1 provenance validation.
2. Review readiness_broker/snapshot.rs for v3 path selection, legacy read fallback, cross-root rejection, and sidecar-v2 to broker-v3 GPU binding.
3. Review machine-lock schema pairing and the shared path-comparison replacements.
4. Review the migration and platform tests in readiness_broker/tests.rs.

Verification

• cargo test -p codestory-cli readiness_broker — 53 broker unit tests plus broker CLI integration passed.
• cargo test -p codestory-workspace repository_identity — 19 passed.
• Focused local-refresh and ready-repair suites — 16 and 35 passed.
• cargo clippy -p codestory-cli -p codestory-workspace --all-targets -- -D warnings — passed.
• cargo fmt --all -- --check, git diff --check, docs links (69 files / 281 links), and workflow policy — passed.
• Full local CLI suite reached 285/293. The hardware-sensitive unknown-device test observed this machine's live accelerator instead of the test's expected unknown state; its panic poisoned the shared config lock and caused seven dependent failures. The failing test is outside this diff; all changed ownership and identity surfaces pass independently.
• Independent read-only review found no actionable issue in v1/v2 mapping, snapshot isolation, machine-lock schema pairing, or GPU identity migration.

Risk

The migration deliberately leaves old snapshot files in place because a legacy case-folded path can be ambiguous on case-sensitive filesystems. Only state whose stored root, project identity, and legacy workspace identity map unambiguously is read. Screenshot evidence is not applicable; this change has no visual UI surface.