feat(intelligence): add unified resource plane

[eamirian]

Outcome

Starts ACE 0.8C with one domain-neutral, authorized resource plane shared by Atrium, World Intelligence, Market Intelligence, and machine consumers.

What changed

• adds strict versioned contracts for 22 canonical resource families
• adds product-, subject-, kind-, and point-in-time scoped queries
• adds content-addressed pagination that never becomes bearer authority
• adds exact provenance, degraded/tombstoned state, and immediate revision-lineage rules
• adds an application service that re-resolves current Core authority for every page and fails closed on reader scope widening
• exports the contracts and service from the supported ace.intelligence and ace.application packages
• records ownership, remaining C2–C4 work, acceptance, and rollback in the 0.8C packet

Opportunities remains an Atrium view over Cases, not a new kernel resource.

Verification

• 72 focused resource-plane, runtime/ownership, package, schema, kernel, and MCP-surface tests passed
• repository-wide Ruff lint and format checks passed
• real local SurrealDB restart tests could not open loopback sockets in the sandbox; this is an environment limitation, so GitHub CI is the authoritative full-suite gate

Boundaries

No connector, provider, UI, World, Market, legacy-host, persistence, or external-effect implementation enters Core in this slice. C2 will bind rebuildable projections to supported governed records after this seam is accepted.