[codex] bind plugin routing to request identity

[TheGreenCedar]

Outcome

CodeStory's plugin bootstrap now binds readiness to the repository named by the current request. Hook-written active-project files remain diagnostics only, filesystem aliases use native identity, and stale readiness from another project is rejected before packet/search surfaces are reported ready.

Closes #1035
Refs #1032
Refs #913
Refs #899

What changed

• Removed global and thread-active state from plugin project selection; projectless MCP still launches once and each bootstrap request supplies its absolute project root.
• Replaced textual executable/root comparison with one filesystem-aware comparator: existing aliases compare by native file identity, missing paths stay case-sensitive on Unix and case-insensitive on Windows.
• Extended cache identity with the lossless schema-3 project, workspace, and artifact-scope ids plus explicit legacy-alias disposition.
• Cross-checked the selected project identity with schema-3 readiness-broker evidence and fail closed on missing or mismatched ready evidence.
• Updated operator/contributor docs, changelog, and the mandatory repo-scale stats log.

How to review

1. Start in plugins/codestory/scripts/codestory-mcp.cjs: resolveProjectRoot, sameFilesystemPath, probeProjectIdentity, and projectIdentityMismatch define the routing boundary.
2. Review crates/codestory-runtime/src/repository_identity.rs and the CLI renderer for the schema-3 exchange.
3. Review the focused plugin test and the strengthened CLI A/B/A/cache-identity contracts.

Verification

• node --check plugins/codestory/scripts/codestory-mcp.cjs
• node --test plugins/codestory/tests/plugin-static.test.mjs — 72 passed, 1 Windows-only skip
• node .github/scripts/check-doc-links.mjs
• cargo fmt --all -- --check
• focused runtime cache-identity and stdio A/B/A tests
• cargo check --workspace --locked
• pre-rebase cargo test --workspace --locked -q
• pre-rebase cargo clippy --workspace --locked --all-targets --all-features -- -D warnings
• release CLI build plus ignored repo-scale full-sidecar stats: 2 passed; real drill intentionally skipped; CPU allowance was explicit and is not accelerator evidence

The branch was rebased onto 9c97808a; targeted identity tests and the workspace check were rerun after that rebase.

Risk and follow-up

Bootstrap performs one additional read-only cache identity probe. It fails open to diagnostic MCP output if that exchange is invalid, and only ready broker evidence is required to carry a matching schema-3 identity. Legacy alias reuse remains unavailable unless provenance proves it safe.

[TheGreenCedar]

The two independent P2 review findings are fixed at exact head 0d3ef93cbfd6a1ab8ea87ef3434c3da9d3119071.

What changed

• RepositoryIdentityReport now builds repository fields and schema-3 ProjectIdentityV3 fields from the same Git observation through a small shared workspace constructor. This removes the race where the remote/tree/dirtiness inputs could be sampled twice.
• Explicit --project and CODESTORY_PROJECT_ROOT selections now fail closed with project_root_invalid when the supplied path is absent or not a directory. They cannot fall through to the launch working directory.
• The existing bootstrap-status contract test now covers both invalid argument and invalid environment selections from an otherwise valid repository working directory, and proves no runtime command is started.

Verification

• cargo fmt --all -- --check
• cargo test -p codestory-runtime --locked repository_identity
• cargo test -p codestory-cli --locked --test cli_error_contracts cache_identity_json_reports_canonical_contract_fields
• cargo test -p codestory-cli --locked --test stdio_protocol_contracts multi_project_stdio_routes_interleaved_requests_by_explicit_project
• cargo check --workspace --locked
• cargo test --workspace --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• node --test plugins/codestory/tests/plugin-static.test.mjs (72 passed, 1 platform skip)
• node .github/scripts/check-doc-links.mjs
• git diff --check

The PR remains draft while hosted checks rerun against this exact head.