Deepen query projection boundaries and remove test-only engine seams

[ncode]

What

• Route normal CLI formatting, timing names, and strict missing-query classification through one defensive presentation Projection.
• Remove the raw Snapshot fact escape and the single-implementation formatter interface while preserving BuildFormatter.
• Delete ten production-unreachable test-only engine helpers and retarget their tests to production-owned seams.
• Archive both completed architecture changes and sync their capability deltas.
• Include the five previously completed OpenSpec archive/sync changes already carried by this branch:
  • add-hugo-github-pages-site
  • add-packages-fact
  • deepen-discovery-input-surface
  • fix-linux-dhcp-lease-interface-match
  • optimize-bsd-disks-probe
• Raise the pinned Go toolchain from 1.26.4 to 1.26.5 after CI exposed the reachable standard-library advisory GO-2026-5856.

Why

Query semantics already belonged to Projection, but raw resolved facts still crossed the Snapshot-to-CLI boundary and caused presentation rules to be rebuilt. Separately, ten helpers existed in production files solely for tests, allowing tests to bypass the real coordination paths.

This finishes those ownership boundaries without changing Facts behavior and finalizes the already implemented OpenSpec improvements. The toolchain patch keeps CI and Lima builds on the first Go 1.26 release containing the crypto/tls fix.

Impact

Behavior-preserving internal refactor and toolchain security update:

• no public Facts API change
• no CLI output, diagnostics, status, query, or force-dot contract change
• no fact schema or dependency change
• no changelog entry required

Checks

• go test ./...
• go test -race . ./internal/engine ./internal/app
• go vet ./...
• go tool govulncheck ./...
• make build
• all OpenSpec specs validate strictly
• supported and extended target cross-builds
• adversarial architecture reviews
• Open Code Review (user-run; no findings)
• nlab native gates: Debian, Alpine, FreeBSD, OpenBSD, NetBSD, DragonFly BSD, OmniOS/illumos, Plan 9, and Windows