refactor(evidence): unify retained inputs across domains (#8299)

Declare logical Evidence sources once and resolve exact retained inputs through
shared application workflows across 20 composition tools. Preserve domain-owned
authentication, source closure, caller choices, coverage and resource admission.

Validation includes public CLI/MCP regressions, local Codex terra/high trials
and fresh-import real-artifact workflows. Measurements, failed attempts and
coverage limits are recorded in docs/verification/evidence-input-composition-2026-10-31.md.

Fixes #8293.
Fixes #8281.

Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)

src/application/managed/ManagedApplicationGraphService.ts

@@ -1,3 +1,8 @@
+import {
+  resolveEvidenceRequest,
+  type EvidenceLookup,
+} from "../EvidenceInputResolver.js";
+import type { ExecutionOptions } from "../AnalysisProvider.js";
 import type { AnalysisError } from "../../domain/analysisErrorBase.js";
 import {
   createEvidence,
@@ -5,6 +10,7 @@ import {
   type EvidenceSubjectTarget,
 } from "../../domain/evidence.js";
 import {
+  managedApplicationGraphReferenceInputSchema,
   projectManagedGraph,
   readManagedGraphProjection,
   type ManagedApplicationGraphResult,
@@ -19,12 +25,30 @@ const OPERATION = "project_managed_application_graph" as const;
 /** Project authenticated managed Evidence into a provider-neutral graph. */
 export const projectManagedApplicationGraphEvidence = (
   rawInput: unknown,
+  lookup?: EvidenceLookup,
+  options: Pick<ExecutionOptions, "signal"> = {},
 ): Result<Evidence, AnalysisError> => {
-  const request = readManagedGraphProjection(rawInput);
+  const request = resolveManagedGraphEvidenceInput(rawInput, lookup, options);
   if (!request.ok) return request;
   return ok(projectManagedGraphEvidence(request.value));
 };
 
+/** Resolve selected records before the managed owner authenticates and joins them. */
+export const resolveManagedGraphEvidenceInput = (
+  rawInput: unknown,
+  lookup?: EvidenceLookup,
+  options: Pick<ExecutionOptions, "signal"> = {},
+): Result<ManagedGraphProjection, AnalysisError> => {
+  const request = resolveEvidenceRequest(
+    OPERATION,
+    rawInput,
+    managedApplicationGraphReferenceInputSchema,
+    lookup,
+    options,
+  );
+  return request.ok ? readManagedGraphProjection(request.value.input) : request;
+};
+
 /** Project the workflow owner's authenticated, identity-checked source facts. */
 export const projectManagedGraphEvidence = (
   request: ManagedGraphProjection,