feat: safe invocation rejection diagnostics

[SonAIengine]

Summary

Preserve the existing invocation_invalid verdict, exit 20, journal settlement and no-retry behavior. Add an optional versioned headless terminal line with fixed category/field constants only. No raw input, paths, dynamic property names, validator messages or schema text is emitted.

ADR-0038: ephemeral diagnostics are not durable evidence or recovery authority. Provider grammar, REPL display, protocol/store schema and execution permissions are unchanged. No live provider or production deployment.

Verification

• Full Rust workspace: 574 tests passed (45 result groups), including six native CLI rejection fixtures and existing normal execution/resume cases.
• Workspace clippy with warnings denied, format, release build, bundled protocol, third-party licenses, npm contract + 14 tests, release workflows and RC3 docs checks passed.
• Host adapter/failure accounting/recovery regression: 114 tests passed.
• Release CLI to host loopback: seven cases passed; normal write/verification/completion and six distinct fixed diagnostics, one request and no effects for every rejection.

Local environment caveat

Normal-disk local tests encountered filesystem journal commit waits (jbd2_log_wait_commit), causing two existing REPL test timeouts and host process timeouts. With a dedicated tmpfs temporary directory, the same code and unchanged timeouts passed the complete workspace and host suite. No journal/fsync safeguard was disabled. tmpfs is functional verification, not disk power-loss certification. All six required upstream CI checks must pass before merge.