Core module carve-out: design twice, implement, migrate via promote #50

Part of #44 — spec item 7.

The genuinely identical machinery (name matching, manifest io + hashes, config splice, entry predicate, effective-version pipeline, cache paths) becomes one deep module whose interface declares policy at the seam; the suite CLI and the generated CLI become its two adapters. Consumer packages stop vendoring machinery; templates shrink to adapter renderings that scaffold emits.

Process:

1. Design twice before implementation — parallel interface designs compared on depth, locality, seam placement. Preferred shape: a slim subpath export rather than the whole plugin as a dependency.
2. Policy declared at the seam (allowed commands, scope coverage), not parameterized ad hoc. The divergence manifest from the sync-table ticket defines the policy seam.
3. Explicit manifest-format compatibility rule before any generated package depends on it.
4. Prove the dependency end-to-end through the rendered fixture (generated package depends on the core module; install, status, uninstall must pass) before migrating any real consumer package.
5. Migrate consumer packages via promote (adoption per-package, owner-driven — out of scope here beyond the mechanism).
6. Record an ADR: templates shift from structural source of truth to adapter renderings — ADR-0005's resolution mechanics stand, its truth-source role is superseded.

Preserved everywhere: ADR-0006 invariants (scope-aware, manifest-gated install; semantic entry matching; surgical config edits; hooks never throw); ADR-0004 mode exclusivity untouched. Hand-edited installed files keep consumer-modification protection.