feat: use neutral Code section roots for new repositories

[dayebishouji]

What changes and why

New aoci init repositories start their Code Volume with ===project/.code/===; later sections use coordinates such as ===/.code/src/=== instead of a contributor's machine path. This implements the new-repository default discussed for 0.2.0 in #76.

The exact marker selects neutral resolution before runtime-path matching, including checkouts at /.code/src. It survives deletion of the last Entry so reinsertion keeps neutral coordinates. Existing unmarked indexes retain their interpretation and bytes. An interrupted older initialization can finish with its exact marker-only Code skeleton and matching Baseline fingerprint.

Fixes #76.

Affected public contracts

• No public contract change
• MCP names, input schemas, or response shapes
• CLI commands, flags, exit codes, or JSON shapes
• Public contract text (spec/public/aoci-index-format-v1.txt)
• Index section-root convention

The existing header grammar, canonical object identities, layout version, and transaction schemas are unchanged. rc15 reads a newly authored neutral index aligned in ordinary original/clone locations, verified against the checksum-verified release binary. Older readers do not provide the new overlapping-path or last-deletion guarantees; the upgrade guide explains these limits.

Verification

Remote fast CI: 8/8 passed for ee0bfd3 (run).

Passed locally:

• make fast, full go test ./... -count=1, and full go test -race -count=1 -timeout=30m ./....
• Pinned staticcheck, public-text safety, connector provenance replay, and the 22-row release license inventory.
• govulncheck: no reachable vulnerabilities; it reported 26 findings in required modules that this code does not call.
• Updated clean-room-smoke: neutral anchor, zero Entries, production scope roles, and bounded authoring Guide.
• MCP conformance: 46 passed, 0 failed, on the final commit in an ordinary Linux clone.
• Fault-injection scenarios: 61 passed, 0 failed. Targeted neutral-root/special-name scenarios also passed on native Windows.
• Native Windows regression tests; newly authored fixture verified aligned in original and cloned locations by both the new binary and released rc15, with unchanged Code bytes.
• git diff --check.

make verify was run with keep-going aggregation and all three black-box suites. Its initial run was not green: local tools were missing, WSL could not resolve the Windows worktree's .git pointer, and the database lifecycle suite could not start Docker. Missing tools were installed and their gates passed on rerun; clean-room smoke and conformance passed from an ordinary clone. The lifecycle result was 53 PASS, 2 CHAR, 1 FAIL, with the sole failure in Docker-backed database setup. The integration-tag Go command passed with live database tests skipped because no database environment was configured. Live database acceptance remains unverified locally.

Regression coverage includes relocation, Windows paths, nested worktrees, runtime roots overlapping neutral coordinates, same-named Entry updates, delete/reinsert, inconsistent section families, unchanged historical interpretation, repeated init, and interrupted older init. The black-box harness and clean-room assertion now expect the new default.

Operating system impact

Pure index-coordinate handling shared by Linux, macOS, and Windows. No internal/fs change or new dependency. Native Windows tests and Linux/Windows builds passed.

Migration and recovery

No migration or extra approval is required. Existing indexes are not rewritten or retroactively marked. Initialization retains the dependency-before-Root publication order and exact-postimage conflict checks.

Cognition

• Maintain and complete candidate updates followed by Verify, Check, and Guide: aligned, complete=true, next_action=none.
• Index and Baseline changes are included; ordinary package tests remain Observe.