feat: administer explicit experience sharing grants - #9

Add IExperienceCandidateSource with a PostgreSQL implementation: scope, status
and confidence filtering plus a full-text match over a generated tsvector
column added by migration 0003. Core's ExperienceRetrievalService applies
expiry and environment eligibility, then ranks candidates on relevance,
confidence, recency, status and environment compatibility with configurable
validated weights, exposing every normalized component and effective weight.

Retrieval is bounded by a timeout that returns an empty result with a timeout
signal rather than throwing, caller cancellation stays distinct, and a capped
candidate pool is reported through Truncated.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Add IExperienceEmbeddingIndex and a domain-typed embedding generator port,
with a new AgentExperience.Storage.Postgres.Vectors package implementing them
over plain Npgsql and Pgvector. Embeddings are derived data: indexing runs
after the canonical commit, embeds only the sanitized retrieval summary of an
eligible record, and writes conditionally on the record's exact revision, so a
stale write is rejected and a deleted record is never recreated.

Retrieval gains a vector channel merged with the text channel under the same
eligibility, timeout and ceiling. A model or dimension mismatch, an
unavailable provider, or a vector-channel failure produces an explicit
flagged text-only result rather than an incompatible comparison.

The vectors package owns and applies its own schema, so a text-only
deployment never runs CREATE EXTENSION vector.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Add ExperienceContextProvider, a simple-tier AIContextProvider the host adds
to ChatClientAgentOptions.AIContextProviders. It retrieves ranked experience
before an invocation, re-checks every candidate against the same eligibility
rules retrieval applies, asks the host's injection decision, and injects a
delimited Historical Reference carrying source, confidence, applicability and
an evidence summary -- never raw payload content, never a cut record.

Limits drop whole records and record every omission. Retrieval that is empty,
times out or fails leaves the agent running normally. Labeling marks the
content untrusted; the authorization boundary is what denies an unauthorized
tool call, and a test proves it does when the model obeys injected text.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Add IExperienceGrantStore and migration 0005: an administrator, with authority
the host supplies explicitly, grants one record to a recipient scope with a
reason and an expiry. The grant row and its audit event commit together, and a
unique partial index allows at most one active grant per recipient, so revoking
the grant an administrator knows about ends that recipient's access.

Reads widen in SQL only: get, text search and vector search match their exact
scope or an active grant, evaluated against the database clock. Writes,
lifecycle commits, history and enumeration stay owner-only. The read that
applied the predicate marks a record as shared, so Core and the injection
provider keep strict scope equality for everything else, the host's risk
policy can deny borrowed experience, and the model is told the lesson came
from another scope.

Deployments without the grants table, or with SELECT only on the record table,
degrade to exact-scope reads rather than failing.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>