fix(reference)!: retain source and metadata cleanup owners

Require a caller-owned artifact resource scope for source traversal and Git metadata reads. Preserve cancellation, filesystem reasons, partial entries and bytes, and cleanup observations through import and the CLI. Transfer exact failed file owners at regular-file admission and close boundaries, including multiple failures encountered by Git reference resolution.

Validation: 169 focused tests passed across 26 files; two Windows-only cases skipped. Build, typecheck, lint, formatting, knip, architecture guards, discovery and docs checks passed.

BREAKING CHANGE: Reference source readers and imports require an ArtifactResourceScope. VCS metadata reads return Result, and CLI import failures include observed details and partial evidence.

src/reference/ReferenceSourceReaderTypes.ts

@@ -1,6 +1,8 @@
 import { type BigIntStats } from "node:fs";
 
 import { type Result } from "../domain/result.js";
+import type { AnalysisCleanupObservation } from "../domain/analysisErrorBase.js";
+import type { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.js";
 
 export type ReferenceSourceEntryKind =
   | "file"
@@ -65,6 +67,10 @@ export interface ReferenceSourceReaderError {
   readonly tag: "reference-source-reader";
   readonly code: "cancelled" | "invalid-root" | "io" | "unsupported";
   readonly message: string;
+  readonly cleanup?: AnalysisCleanupObservation;
+  /** Captured entries before failure; this does not establish complete tree coverage. */
+  readonly partial?: ReferenceSourceRead;
+  readonly cause?: unknown;
 }
 
 export type PendingDirectory = {
@@ -72,6 +78,7 @@ export type PendingDirectory = {
 };
 
 export type TraversalState = {
+  readonly resources: ArtifactResourceScope;
   readonly root: string;
   readonly rootIdentity: BigIntStats;
   readonly signal?: AbortSignal;
@@ -85,6 +92,7 @@ export type TraversalState = {
 };
 
 export type StableFileRequest = {
+  readonly resources: ArtifactResourceScope;
   readonly root: string;
   readonly rootIdentity: BigIntStats;
   readonly absolute: string;