adf compile: preserve retained sections instead of only refusing on them

[stackbilt-admin]

Follow-up from #295 / PR #300 (merged as 1856a64), raised by review of that PR.

PR #300 made adf compile --write refuse, rather than silently destroy, a charter pointer file carrying user content under a retained heading (## Environment and the other headings isRetainedHeading recognises). That closed the path where content actually accumulates, because adf tidy deliberately re-appends retained sections and the pre-commit hook runs tidy automatically.

Residual hole

The retained-content guard sits under if (replacedPointer) (adf-compile.ts:256). So compile over an already-compiled file — one carrying COMPILE_BANNER_MARKER — with a user-added ## Environment block still destroys it silently, exit 0, no --force required.

This predates PR #300 and is strictly narrower than what that PR fixed, since a banner-bearing file says DO NOT EDIT at the top. But it is the same class of data loss, and git remains the only recovery: renderToVendorFormat (packages/adf/src/compiler.ts:161-220) emits banner, title, role, default sections and module index — never an Environment section — so there is no round trip that restores it.

The better end state

Teach compile --write to preserve retained sections rather than only refusing on them: export readRetainedSections (now exported at adf-tidy.ts:292) and re-append its result to the compiled output.

This was deliberately NOT done in PR #300 because it is a change to the compile contract, not a bugfix. Two consequences to design around:

1. A compile artifact stops being pure generated output and becomes generated-plus-preserved.
2. runCheckMode (adf-compile.ts:234) is a strict onDisk === result.output byte comparison. Appending preserved content makes --check report permanently [stale] for any file with an Environment block. That has to be reconciled in the same change.

Related, lower priority

• adf-compile.ts:181 — the pointer-replacement annotation exists only on the text output path. The JSON written array is bare filenames, so a JSON consumer cannot distinguish a pointer conversion from an ordinary re-compile. Worth a replacedPointers field.
• adf.ts:291 — POINTER_MARKERS are prose strings rather than sentinels, so a hand-authored file that happens to quote one is admitted as charter-owned. Pre-existing and shared across six call sites; noted because PR fix(adf): accept charter pointer stubs in compile overwrite guard #300 added a destructive consumer of that list.

Identified during constellation-loop review of PR #300.