feat(context-engine): D3 P0-A — surface cold-item slug + record injected slugs (attribution substrate)

[ProtocolWarden]

What & why

The P0-A substrate for D3 "attribution scheme A" — explicit Context-Used: <slug> citation. Before an acting agent can cite the cold memory it used, two things must exist: (1) the slug must be visible in the injected context, and (2) the system must have a record of which slugs were injected (and when) to match a later citation against. This PR adds both. It is groundwork only — no consumer of the citation yet, and no promotion-gate behavior change.

Changes (two focused, non-breaking edits)

A. Surface the slug (context_engine/cold.py)
surface_cold now prefixes each surfaced cold line with a machine-parseable [<slug>] citation token:
[projection] projection — src/x/** — Redaction must run before validation.
The human topic — glob — finding content after the token is unchanged. What surfaces, and when, is untouched.

B. Record injected slugs + ts (context_engine/route.py)
_log_injection_event writes a new cold_slugs field to the injection telemetry JSONL — [{"slug": ..., "ts": ...}] per surfaced cold item, ts = injection time — in addition to the existing cold_surfaced count and every current field. Slugs are recovered from the surfaced lines by a new _cold_slug_from_line helper that skips the ...(N more) truncation note. Fully backward compatible: existing telemetry consumers/tests read the same old fields.

Test coverage

• tests/test_cold_store.py: updated the two exact-line assertions to include the token; added a parse-back test (line carries a [slug] that parses to the slug and the human content is preserved intact).
• tests/test_context_router.py: cold_slugs recorded (slug + ts) with the legacy cold_surfaced count and all other fields unchanged; the ...(N more) truncation note is excluded from cold_slugs.
• Full suite: 412 passed; ruff check . clean; SPDX headers present. Custodian pre-push audit: 0 findings, clean.

🤖 Generated with Claude Code