Harden semantic report mode

[marlian]

Summary

• Bound semantic report embedding requests and per-entity work with configurable caps and visible report limit signals.
• Keep semantic report mode cache-write-only by opening existing DBs without migrations or missing-DB creation across global/project scopes.
• Sanitize embedding provider diagnostics and update docs/contracts for the hardened report-only boundary.

Validation

• go test ./internal/semantic ./internal/reconcile ./internal/embedding ./internal/store ./cmd/workmem
• go test ./...
• git diff --check
• VSCode code checker (Error): no issues
• Local architecture review rerun: no Blocker/Risk

[Copilot]

Pull request overview

This PR hardens semantic reconcile report mode by bounding embedding/provider work, preserving the report-only/cache-write-only boundary, and updating user-facing contracts and documentation.

Changes:

• Adds semantic report caps for request chunking, per-entity observation comparison, and per-entity candidate output with visible limit signals in reports.
• Opens semantic report DBs without running migrations or creating missing global/project DBs.
• Sanitizes embedding provider diagnostics and expands tests/docs around the hardened behavior.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Documents new semantic report limits and report-only persistence boundary.
OPERATIONS.md	Adds operational rules for no-migration report DB opens, resource caps, and sanitized provider errors.
IMPLEMENTATION.md	Marks semantic reconcile phase complete and adds report hardening gate details.
DECISION_LOG.md	Records the decision to bound semantic report mode before release.
ARCHITECTURE.md	Updates semantic report architecture with no-migration opens, caps, and diagnostics behavior.
API_CONTRACT.md	Extends semantic report contract with no-migration behavior, caps, and error-sanitization requirements.
.github/copilot-instructions.md	Updates repository review guidance for semantic report hardening invariants.
internal/store/sqlite.go	Adds existing-DB open path that skips schema migration.
internal/store/sqlite_test.go	Tests no-migration existing DB behavior and file hardening.
internal/semantic/report.go	Implements chunked embeddings, per-entity caps, limit metadata, and report mutation count.
internal/semantic/report_test.go	Covers chunking, cache reuse, cap reporting, and cache-only mutation behavior.
internal/reconcile/report.go	Renders semantic cap settings and limit signals in markdown reports.
internal/reconcile/report_test.go	Verifies semantic report rendering includes safety, caps, escaping, and limit signals.
internal/embedding/client.go	Sanitizes transport/provider HTTP errors without exposing response bodies or URLs.
internal/embedding/client_test.go	Verifies sanitized HTTP status and transport-error output.
cmd/workmem/reconcile.go	Adds CLI flags and no-migration DB opening for semantic report mode.
cmd/workmem/main.go	Updates CLI usage text for semantic hardening flags.
cmd/workmem/main_test.go	Adds CLI coverage for sanitized provider errors, project scope, and no-create/no-migrate DB opens.