feat(topology): Add project and module topology

[reneleonhardt]

What does this PR do?

Adds a typed project/module topology graph alongside the existing file dependency graph:

• Defines deterministic graph types, provider boundaries, runtime-scoped caching, and fail-closed validation.
• Adds topology to existing CLI, MCP, context, and blast-radius surfaces with bounded output.
• Retains topology and configured-file membership in watch state, refreshing them when manifests, filters, or ignore rules change.
• Invalidates topology caches when provider-visible file metadata or project configuration changes, and skips topology work for empty diffs.
• Preserves the completed file graph when provider work is cancelled, while propagating cancellation during inventory scans.

Why it matters

File dependencies show source-level edges but not project or module ownership. This adds bounded topology context without invoking project build tools.

CLI / MCP surface

• codemap --topology and module context use the selected project root.
• Existing context and blast-radius output includes topology impact.
• MCP adds topology views while keeping existing tools available.

Coverage provenance notes

Coverage reports unavailable, partial, and provider-failure states explicitly. Invalid or stale caches are rejected, transient failures are not cached, and tests cover cache identity/atomicity, provider isolation, cancellation, filtering, bounded output, path validation, and watch refresh paths.

Verification

• go test ./topology ./watch ./mcp
• go test -race -p 1 ./topology ./watch ./mcp ./scanner