refactor(core,api,cli): centralize UUIDv5 namespace derivation

[DecisionNerd]

Split from #1020 after architecture review.

Scope

Direct Uuid::new_v5 namespace derivation is scattered across api/portable.rs, api/composite_publish.rs, and cli/hub_clone.rs despite the shared namespace facility in graphforge-core/src/uuid.rs.

Acceptance criteria

• All GraphForge-owned deterministic UUID derivation routes through the shared core API
• Domain separators remain explicit and collision-resistant
• Existing UUID outputs remain byte-for-byte stable, proven by golden vectors
• Direct namespace derivation outside the shared module is rejected by a focused policy test