feat: enforce Artic source role metadata

[baskduf]

Summary

• Enforce Artic source-role metadata during role-grounded source selection.
• Prevent role-ineligible sources from re-entering as fallback references after rejection.
• Preserve source_role, default_visual_reference, and requires_explicit_context in init selected_sources and source_plan outputs.
• Sync Claude/Codex plugin script mirrors.

Scope

• PR B only: runtime source metadata gating + init output metadata preservation.
• No scoring weight changes, no facet/avoid CLI changes, no clean-saas fallback redesign, no docs/release changes.

Test Plan

• New regression tests were written and observed failing before implementation.
• python3 -m pytest -q → 104 passed
• python3 skills/artic/scripts/test_artic_scripts.py
• python3 plugins/claude-artic/skills/artic/scripts/test_artic_scripts.py
• python3 plugins/codex-artic/skills/artic/scripts/test_artic_scripts.py
• python3 -m compileall -q skills/artic/scripts plugins/claude-artic/skills/artic/scripts plugins/codex-artic/skills/artic/scripts
• python3 -m build --sdist --wheel
• python3 scripts/build_skill_archive.py --output dist/artic-skill-v0.5.0.tar.gz
• python3 scripts/check_release_artifacts.py --require-payload dist/artic-0.5.0.tar.gz dist/artic-skill-v0.5.0.tar.gz
• python3 scripts/check_release_artifacts.py dist/artic-0.5.0-py3-none-any.whl
• git diff --check
• Independent reviewer pass after blocker fix