feat(parser): reusable source-set framework

[mariusvniekerk]

Adds the reusable source-set bases and functional options that concrete providers compose for discovery, lookup, fingerprinting, and changed-path classification. The framework symbols are exported so they can be consumed across the package without tripping unused-symbol lint at intermediate branches in the stack.

Also adds the WithCompanionFiles option, unifies the path-under-root helper onto a single root-first signature, and removes the dead SQLiteFanoutSourceSet.

Where to look: internal/parser/jsonl_source_set.go, single_file_source_set.go, and the source-set base types.

[mariusvniekerk]

This change is part of the following stack:

• feat(parser): provider facade core #876
  • feat(parser): reusable source-set framework #877 ◀
    • feat(parser): migrate CLI/JSONL providers #878
      • feat(parser): migrate Qwen + QwenPaw providers #879
        • feat(parser): migrate OpenClaw + QClaw providers #880
          • feat(parser): migrate opencode-family providers (opencode, kilo, mimocode) #881
            • feat(parser): migrate bespoke providers (openhands, cursor, vibe, hermes, claude, cowork) #882
              • feat(parser): migrate Codex + editor-extension providers #883
                • feat(parser): migrate SQLite/container providers #884
                  • refactor(parser): require explicit provider factories + migration cleanup #885

_{Change managed by git-spice.}

[roborev-ci]

roborev: Combined Review (37dc43b)

Summary verdict: one medium correctness issue should be fixed before merge; no security issues were found.

Medium

• internal/parser/single_file_source_set.go:192 - SourcesForChangedPath returns nil as soon as the first configured root contains WatchRoot but its classifier rejects the path. With overlapping configured roots, a broad root can prevent a later, more specific root from classifying a valid change, so live updates can be missed.
  • Fix: continue checking other matching configured roots when classifyPath returns false; only return nil after all candidates fail. Add an overlapping-root test.

---

Panel: ci_default_security | Synthesis: codex, 7s | Members: codex_default (codex/default, done, 9m17s), codex_security (codex/security, done, 1m13s) | Total: 10m37s

[roborev-ci]

roborev: Combined Review (f708cf2)

Medium finding only: the new parser source-set fallback paths can bypass freshness checks.

Medium

• internal/parser/jsonl_source_set.go:302 and internal/parser/multi_session_container.go:260
RequireFreshSource is bypassed on stored-path fallback paths. These branches can return a source ref without verifying that the file/member still exists, so normal provider-authoritative sync can proceed to fingerprint/parse stale sources instead of returning not found.
  Fix: When RequireFreshSource is true, validate the fallback source before returning it: stat/reuse source inclusion checks for JSONL, and apply memberPresent for multi-session fallback matches.

---

Panel: ci_default_security | Synthesis: codex, 6s | Members: codex_default (codex/default, done, 6m43s), codex_security (codex/security, done, 2m27s) | Total: 9m16s