Move ColdPath and ToolProvisioning into core; complete api's re-exports

[blooop]

Question

Make api::Launch constructible from core alone, as decided in "Make api::Launch self-sufficient and type ColdRefused": move the real ColdMachinery impl (dl's ColdPath — the config → metadata → migration → clone-manager plumbing of dl/src/session.rs:151-171, minus the printing) and the real Provision impl (dl's ToolProvisioning, dl/src/launch.rs:118-176, minus render::Saying) into devlaunch-core with the event sinks injectable as typed values; dl keeps only rendering. Then complete api's re-exports so every Launch::new parameter type is reachable from api alone (Refresh, Host, Notices<LaunchNotice>, the impls) — today 5 of 7 live outside it. Red-first at the seam: a test constructing a cold-capable Launch using only devlaunch_core::api paths.

[blooop]

Claimed 2026-08-29: build in progress from an interactive session (opus agent in an isolated worktree, managed as part of closing out map #299). PR to follow. If you are another session seeing this, do not double-build.

[blooop]

breadcrumb: built and pushed as PR #514. The two real implementations are in core: flows::launch::ColdPath and flows::launch::ToolProvisioning, each taking its event sink as a constructor argument, with the records themselves in a new flows::records. dl keeps the printer and the words and nothing else, and dl/src/cold.rs is gone. api now re-exports every one of Launch::new's parameter types.

Red first, and it stayed red for exactly the reason the ticket names: a test constructing a cold-capable Launch through devlaunch_core::api alone failed to compile on eleven unresolved imports. It also pins the other half of devlaunch#145 at runtime, that building the launcher opens no records.

One thing the ticket left implicit and the build could not avoid: #339 had to be done here. ColdRefused carried reason: String, filled by dl rendering a StartupError, so a ColdPath living in core would have had to write English. It is now Startup(StartupError) / NoColdPath, the shape #313 decided. That also made domain::config::ConfigError clonable and comparable, its OS side spelled as OsFailure the way MetadataError's already was. #339 is left open rather than closed by the PR, since it asks for a red test of its own; its substance is in the branch and a maintainer reading the spec as satisfied can close it.

Snapshots regenerated for real on nightly plus cargo-public-api 0.52.0, verified byte-identical against main first. The promise file goes 37 rows to 126, all additions and no removals; the rest file's diff is the same types seen from their canonical paths, plus the eleven rows of the old ColdRefused struct. Gates green: cargo test --workspace, clippy -D warnings, fmt --check, and the Python guard suite (427 passed). CHANGELOG entry under [Unreleased]. Not merged.

[blooop]

wf-review on #514: Comment, no blocking findings. Re-export completeness, snapshot honesty (89 additions, zero deletions), byte-identical rendering and the behavioral no-op all verified independently. Four minor doc inconsistencies to fix; #339's shape is satisfied but its named red test is absent, so #339 should stay open. #514 (review)