feat: integrate deja-vu as a managed companion

[pacphi]

Summary

Closes #114.

Integrates deja-vu as an opt-in, Kit-managed companion rather than a host or provider:

• adds a versioned integrations.dejaVu configuration contract, companion registry entry, and strict v0.19.0 health/target parsers
• adds explicit setup controls (--with-deja-vu, --deja-vu-mode, --no-deja-vu) with exact-host installation and one bounded index pass
• adds status, sync, repair, verification, dashboard, and uninstall/purge flows without exposing memory content
• tracks package, target, plugin, trust, and index ownership so external or user-modified resources are not adopted or removed
• documents the lifecycle, ownership boundary, privacy model, troubleshooting flow, dashboard facts, and architectural decision

Adjustments for deja-vu v0.19.0

The issue was filed against older behavior. This implementation follows the issue author's later guidance and the published v0.19.0 contract:

• requires @vshulcz/deja-vu >= 0.19.0 and validates doctor --json --offline schema version 2
• installs only explicit Kit targets with --no-guidance --no-index; it never uses aggregate --all/--auto targets
• leaves package upgrades to npm and observes real registry drift instead of invoking deja update
• performs one bounded deja index after target installation because v0.19.0 warmup also writes guidance
• accounts for host-specific plugin/hook/trust behavior and inspects active Claude/Codex profile roots
• honors an exact DEJA_INDEX_DIR path, including arbitrarily named overrides, while preserving siblings during purge

Safety and ownership

• disabled or unowned integrations perform zero deja-vu subprocess probes
• every companion operation has a deadline and returns normalized, content-free facts
• teardown preflights exact receipts and refuses to delete user-modified package, target, plugin, trust, or index state
• the broader upstream uninstall expansion is avoided by requiring a matching direct target receipt
• unhealthy doctor component states cannot be reported as healthy merely because the process exits zero

Validation

• pnpm run check — typecheck, ESLint, markdownlint, packaging/build validation, and full Node test suite pass
• focused deja-vu/lifecycle suites: 39 passing
• focused deja-vu/teardown suites: 29 passing
• git diff --check passes
• published npm @vshulcz/deja-vu@0.19.0 live smoke: isolated doctor --json --offline parsed successfully as schema 2 with an exact custom index directory

Independent quality review

The brutal-honesty pass found and this branch resolved:

1. hard-coded package drift instead of a real npm latest-version observation
2. receipt presence checks that could remove user-modified wiring
3. false-green health when doctor components were unhealthy
4. absent plugin/trust evidence treated as negative evidence
5. companion probe deadlines that could exceed the dashboard budget
6. missed active Claude/Codex profile roots
7. exact custom index directories rejected during safe purge

Agentic-QE v3.13.12 was used directly. Its security scan raised one apparent eval/exec finding; inspection confirmed it is a false positive on a regular-expression RegExp.exec call. Its coverage analyzer reported no ingested coverage data, so coverage claims above come from the repository's real enforced test gate, not that analyzer. The semantic adviser could not run because its configured providers required an unavailable pay-per-token budget/API key.

The QE-Court survey validated the machine-level multi-vendor panel structure, but the repository has no consumer QE-Court panel/projection. Per the court contract, the court was therefore not convened and no SHIP/REMAND/BLOCK verdict is claimed; a human reviewer remains the final judge.

Residual review note

The two new core companion modules are slightly above the repository's approximate 500-line guidance. They remain cohesive and fully gated, but are candidates for a later readability-only extraction if maintainers prefer smaller modules.