#2588 gatorwalk-factory: runtime core (GW-4)

Part of the gatorwalk-factory rebuild of @swamp/software-factory. GW-1/GW-2 shipped in #2576 (PR 327), GW-3 in #2584 (PR 328). GW-4 is the next step on the self-hosting path (GW-4, then GW-5 gates and limits, GW-6 work-item type, GW-8 driving skill).

The runtime core is the pure state piece: it enforces the lifecycle and records what happened. It never dispatches work, makes network calls or calls an LLM. It is a library under gatorwalk-factory/extensions/models/_lib; the model type that uses it is GW-6.

Scope, from the rebuild plan:

• One model instance per work item, with records under fixed names (no work-item id in record names), so the cross-item leak family (#2526, #1487, #2342) cannot occur by construction.
• An append-only journal of every event with its actor, and an era id (not a timestamp) that a reset starts fresh.
• Transitions carry the expected stage and cycle, checked under the per-instance lock, so a stale write is rejected rather than applied (#1998, #2343).
• Record methods return a validation rejection instead of throwing, because rollbackOnFailure deletes everything a failing method wrote, including the feedback a retry needs.
• One record per approval event, bound to the artifact versions it approved (#1487, #1501).
• A usage slot for tokens, and each stage's resolved inputs recorded on its dispatch, so a stage can later be replayed and evaluated.
• Journal retention that never drops events before they are published or counted.

Obligations carried from GW-2 and GW-3:

• Define the CEL context vocabulary for bindings and cel gates (artifacts, evidence, validations, item), replacing the provisional names, and update lifecycles/build-swamp-extension.yaml and the fixtures to match.
• Keep the rule build-swamp-extension relies on: in CEL, evidence['x'] is the latest record of x from any stage, unlike the stage- and cycle-scoped evidence-recorded gate. Add a test that pins it.
• Define dispatch mode with no skills listed as one reviewer subagent.
• Render {{name}} placeholders at dispatch with template.ts, and fix its known bug: a binding that resolves to a map or list containing a CEL integer (cel-js BigInt) makes JSON.stringify throw.

Out of scope: gate evaluators and limits (GW-5), the model type and lifecycle holder (GW-6), graph analysis (GW-9). Nothing is published: gatorwalk-factory stays manifest-free until go-live.