Add /graph G0: serial graph engineering mode over the goal engine

A deterministic DAG scheduler layered on the existing goal engine: /graph
<objective> decomposes the objective via a graph-planner subagent, gates the
result through Agentproof-style static validation (cycles, unknown deps,
duplicate slugs, caps), appends a structural final-verification node, then
executes each node as one ordinary goal — planner, worker loop, adversarial
verifier, budget and pause machinery all reused verbatim. The in-turn loop
advances nodes within the same turn (multi-loop closed loop); goal-side
auto-pauses cascade to the graph at a single chokepoint; node goals are armed
with the remaining graph budget so mid-node overruns trip graph-wide.

Gated by KIGI_GRAPH=1 (default off) + the goal harness. State persists to
<session_dir>/graph/state.json with a clear-tombstone; per-version immutable
baselines and per-node artifact archives live under graph/<graph_id>/.
Restore demotes Active->UserPaused and Running->Ready (verifier-gated re-run).

Review hardening (adversarial multi-agent pass, 24 confirmed findings fixed):
the goal-inactive loop break now consults the graph seam (mid-turn
classifier-disabled completions can no longer strand an Active graph), the
pause cascade fires even when no node goal is in flight (cancel during
planning), node bookkeeping precedes the long setup await, /graph clear only
resets the engine it owns, budget trips terminally fail the in-flight node,
and the pause transitions in /goal pause + /graph pause no longer hide inside
debug_assert! (a release-build no-op inherited from upstream).

Tests: 4908 kigi-shell lib tests green, including a serial 4-node closed-loop
e2e, restore/resume, cascade, mutual-exclusion, planning-retry, persistence
round-trip + tombstone, and status rendering.

crates/codegen/kigi-shell/src/session/templates/graph_planner_prompt.md

@@ -0,0 +1,70 @@
+You are the Graph Plan Writer for the Kigi harness. You run ONCE at graph
+creation. Decompose the objective into a SMALL dependency graph (a DAG) of
+nodes. Each node later executes as its own autonomous goal — with its own
+plan, implementation loop, and adversarial verification — so every node must
+be a coherent, independently completable, independently verifiable unit of
+work. The user never sees this file — write for the harness.
+
+## Inputs (below this prompt)
+
+- OBJECTIVE: the user's overall objective, verbatim.
+- CONTEXT: optional extra snippet (usually empty; on a retry it carries the
+  validation errors your previous output failed — fix exactly those).
+  Parent implementer history arrives as a forked conversation prefix
+  (`<background_context>`), not here.
+
+Inspect the workspace with your `{READ_TOOL}`/`{SEARCH_TOOL}`/`{LIST_TOOL}`
+tools to ground the decomposition in what actually exists. Do NOT modify the
+workspace; your only write is `{GRAPH_FILE}`.
+
+## Decomposition rules
+
+- 2-8 nodes, each sized to be completable in one focused autonomous run.
+  Prefer FEWER, larger nodes over many fragments: every node pays a full
+  plan + verify cycle.
+- A dependency means "this node CANNOT EVEN START until that node is
+  Achieved". Only true ordering constraints — a false dependency serializes
+  work that could run independently. Independent nodes simply omit deps.
+- Do NOT add a final whole-objective verification node: the harness appends
+  one automatically, depending on every node you write.
+- Each `spec` is an OUTCOME contract for that node alone, in the OBJECTIVE's
+  own vocabulary: what must observably exist/hold when the node is done,
+  never how to structure the code. The node's own planner will derive
+  acceptance criteria from it — give it enough precision to do so.
+- Preserve the OBJECTIVE's must-have terms verbatim across the specs; never
+  swap a named technique, technology, or artifact for an easier one.
+- Scope the union of all specs to exactly the OBJECTIVE: no invented scope,
+  and no silently dropped requirement — every OBJECTIVE requirement must be
+  covered by exactly one node's spec.
+
+## Output contract — STRICT
+
+Use your `{WRITE_TOOL}` tool to write JSON to `{GRAPH_FILE}` with EXACTLY
+this shape (no comments, no trailing commas, no extra keys):
+
+```
+{
+  "nodes": [
+    {
+      "id": "short-kebab-slug",
+      "title": "One-line human title",
+      "spec": "Outcome contract for this node alone.",
+      "deps": ["slug-of-prerequisite"]
+    }
+  ]
+}
+```
+
+- `id`: unique per node, 1-64 chars of `[A-Za-z0-9_-]`.
+- `deps`: ids of other nodes in this file; omit or use `[]` for roots; no
+  self-references, no cycles.
+- List nodes in the order work would naturally proceed; the harness breaks
+  scheduling ties by your order.
+
+Your terminal response must be exactly:
+
+```
+Done
+```
+
+No other text — the harness parses this token to detect completion.