Make api::Launch self-sufficient and type ColdRefused

[blooop]

Question

api::Launch is the frozen wf surface, but Launch::new requires &mut dyn ColdMachinery and &dyn Provision whose only real implementations live in the dl binary (dl/src/cold.rs:52, dl/src/launch.rs:138) — a second consumer must reimplement dl's wiring or gets a launcher that cannot go cold. And ColdRefused.reason: String carries dl-rendered English back through core (flows/launch.rs:1831 ← dl/src/cold.rs:64 render::startup_reason) — the one place the no-English-in-core layering runs backwards.

Decide where the impls should live and the typed reason's shape (consult constructive-modeling). Then slice the builds.

[blooop]

human-decided: Move the real impls into core and type the reason, as asked and as answered.

ColdPath's substance is pure core-type plumbing — config → metadata open → cache migration → clone manager (dl/src/session.rs:151-171) — except two rendering steps that stay in dl: the notice printing (commands::report) and the English (render::startup_reason). ToolProvisioning is all core types except the render::Saying event sink. Both impls move into core with the sinks injectable (typed events out; dl keeps only the words), so a second consumer constructs a launcher that can go cold from core alone. And api re-exports the constructor parameter types it currently omits (Refresh, Host, Notices<LaunchNotice>, the impls themselves) — without which "frozen surface" is not self-sufficient: today 5 of Launch::new's 7 parameter types live outside api.

ColdRefused.reason: String — the one place dl's own prose travels back through core (dl/src/cold.rs:64 → flows/launch.rs refusals), against the crate's own #251 §5 rule — becomes a sum type over the existing startup reasons (NoHomeDirectory / Config(ConfigError) / Metadata(MetadataError), payloads already core types, mirroring dl's private StartupError) plus a no-cold-path arm replacing NoColdPath's English literal (flows/launch.rs:1911-1916). Precedent followed: NotRefreshed (repo_manager.rs:336-359) — typed arms, dl owns the words, retained Strings only for another program's output.

Graduates two builds: (1) type ColdRefused; (2) move the impls and complete api's re-exports — (2) blocked on (1), both blocked on the snapshot re-scope so the promise file moves knowingly.