refactor(fs): split filesystem seam into provider ctx.fs + policy ctx.fileContext

Implements the split-the-filesystem-seam RFC. ctx.fs shrinks to a text-storage
provider seam (resolve/stat/readText/streamText/writeText/editText with branded
FsTargetKey/FsVersion and an explicit FsWriteExpectation); the new
dsh-file-context package owns the model-facing policy (read windowing,
observed-state, write/edit freshness) as the concrete ctx.fileContext service.

Authorization is now freshness-based rather than full/partial view: a windowed
read records the file version and authorizes a later edit when the file is
unchanged, removing the dead-end where reading lines 100-150 of a large file
could not edit line 120. editText stays a provider primitive so version guard +
literal match + atomic rewrite remain one critical section, and the stale check
runs before matching so a stale edit reports FS_STALE_VERSION. tool-fs injects
fileContext, never reaching around to ctx.fs (the no-bypass contract).

docs/module-graph.md

@@ -10,6 +10,7 @@ graph TD
   bash --> brand
   llm --> brand
   bash-local --> bash
+  fs --> brand
   fs --> llm
   llm-deepseek --> llm
   llm-pi-ai --> llm
@@ -19,6 +20,7 @@ graph TD
   agent --> brand
   agent --> llm
   agent --> session
+  file-context --> fs
   fs-local --> fs
   llm-replay --> llm
   llm-replay --> session
@@ -51,6 +53,7 @@ graph TD
   tool-bash --> bash
   tool-bash --> llm
   tool-bash --> tools
+  tool-fs --> file-context
   tool-fs --> fs
   tool-fs --> llm
   tool-fs --> system-prompt
@@ -79,12 +82,13 @@ graph TD
 | `bash` | `brand` |
 | `llm` | `brand` |
 | `bash-local` | `bash` |
-| `fs` | `llm` |
+| `fs` | `brand`, `llm` |
 | `llm-deepseek` | `llm` |
 | `llm-pi-ai` | `llm` |
 | `session` | `brand`, `llm` |
 | `system-prompt` | `llm` |
 | `agent` | `brand`, `llm`, `session` |
+| `file-context` | `fs` |
 | `fs-local` | `fs` |
 | `llm-replay` | `llm`, `session` |
 | `session-persistence` | `session` |
@@ -96,7 +100,7 @@ graph TD
 | `acp` | `agent`, `llm`, `session`, `session-persistence`, `tools` |
 | `agent-loop` | `agent`, `llm`, `session`, `session-persistence`, `system-prompt`, `tools` |
 | `tool-bash` | `agent`, `bash`, `llm`, `tools` |
-| `tool-fs` | `fs`, `llm`, `system-prompt`, `tools` |
+| `tool-fs` | `file-context`, `fs`, `llm`, `system-prompt`, `tools` |
 | `agent-core` | `agent`, `agent-loop`, `invariants`, `llm`, `session`, `system-prompt`, `tool-bash`, `tools` |
 | `acp-agent` | `acp`, `agent-core`, `session-persistence-jsonl` |
 | `stdio-agent` | `agent`, `agent-core`, `session`, `session-persistence-jsonl`, `ui-stdio` |