refactor(query): add admission and normalizer

[Ahoo-Wang]

Summary

• add a one-pass, bounded raw admission boundary that snapshots legacy query DTOs into deeply immutable internal values
• add stable typed rejections for malformed shapes, budget exhaustion, temporal errors, and unsupported native queries
• normalize all wire operators into a backend-neutral query model using MongoDB baseline semantics, including empty collections, numeric canonicalization, ordered embedded documents, element scopes, and frozen-clock time ranges
• preserve mixed projections for the P1-C planner instead of choosing compatibility policy prematurely
• update the architecture plan with the implemented P1-B boundaries

Why

The query architecture upgrade needs a deterministic semantic boundary before policy, planning, routing, and backend compilation. Legacy DTOs can expose dynamic getters and mutable Any graphs, so validation alone is vulnerable to TOCTOU and resource amplification.

This PR establishes the immutable admitted snapshot and normalizer without wiring them into production execution.

Compatibility / impact

• stacked on refactor(query): add semantic kernel #2909
• no changes to supported public query APIs, wire DTOs, Spring beans, backend drivers, or OpenAPI schemas
• all new runtime types remain under me.ahoo.wow.query.internal
• legacy unbound RAW driver objects are discarded and rejected on the planned path
• Kotlin internal classes remain JVM-visible implementation details; this is not claimed as a zero JAR ABI diff

Verification

• ./gradlew :wow-query:check --rerun-tasks
• ./gradlew :wow-query:test --tests 'me.ahoo.wow.query.PublicQueryContractCompatibilityTest' :wow-openapi:test --tests 'me.ahoo.wow.openapi.snapshot.OpenApiCompatibilitySnapshotTest'
• git diff --cached --check
• final staged diff reviewed independently for DTO/admission, operator semantics, and rejection/test coverage; no actionable P0/P1/P2 findings remain

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 487 complexity

Metric	Results
Complexity	487

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov]

Codecov Report

❌ Patch coverage is 77.44565% with 249 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.68%. Comparing base (3cbb469) to head (ffc4c44).

Files with missing lines	Patch %	Lines
.../wow/query/internal/admission/RawAdmissionGuard.kt	72.51%	60 Missing and 34 partials ⚠️
...ow/query/internal/admission/RawValueSnapshotter.kt	59.33%	37 Missing and 24 partials ⚠️
...ahoo/wow/query/internal/admission/AdmittedQuery.kt	72.41%	29 Missing and 3 partials ⚠️
...ow/query/internal/normalization/QueryNormalizer.kt	92.15%	14 Missing and 13 partials ⚠️
...hoo/wow/query/internal/rejection/QueryRejection.kt	84.41%	10 Missing and 2 partials ⚠️
...oo/wow/query/internal/admission/AdmissionBudget.kt	65.51%	8 Missing and 2 partials ⚠️
...ow/query/internal/normalization/NormalizedQuery.kt	78.94%	8 Missing ⚠️
...ow/query/internal/normalization/NormalizedValue.kt	37.50%	4 Missing and 1 partial ⚠️

Additional details and impacted files

@@                              Coverage Diff                              @@
##             agent/query-service-p1a-semantic-kernel    #2910      +/-   ##
=============================================================================
- Coverage                                      92.21%   91.68%   -0.54%     
- Complexity                                      6843     7092     +249     
=============================================================================
  Files                                            990      997       +7     
  Lines                                          26327    27428    +1101     
  Branches                                        2713     2890     +177     
=============================================================================
+ Hits                                           24277    25146     +869     
- Misses                                          1138     1290     +152     
- Partials                                         912      992      +80     

Flag	Coverage Δ
contract	47.18% <ø> (-0.07%)	⬇️
integration	75.08% <ø> (ø)
local	87.41% <77.44%> (-0.39%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.