feat(stores): pluggable per-artifact backends via typing.Protocol

[mlieberman85]

Summary

Introduces darnit.stores -- four per-artifact typing.Protocols
(ProjectStateStore, AttestationStore, ReportStore,
AuditCacheStore) plus filesystem-default backends shipped in
darnit-core. Third-party packages register alternatives via
importlib.metadata entry points under
darnit.stores.{project,attestation,report,cache}.

Motivation (see spec.md User
Stories 1-4): darnit-core stays filesystem-only per constitution I,
but downstream users need to point specific artifact classes at
alternative targets (project state to shared Postgres, attestations to
S3, ...) without forking. This lays the seam without touching
zero-config behavior.

Key mechanics

• resolve_stores validates selections eagerly (SC-007) via a
  class-shape Protocol check but defers construction to first access
  (SC-004). A backend whose kind the run never touches is never
  instantiated. close_all() runs at audit-boundary teardown, only
  for stores actually accessed.
• Discovery is per-process cached. Name collisions raise
  StoreNameCollision; broken entry-points are logged and skipped.
• .baseline.toml composes over the framework TOML using
  per-kind replacement (mirrors feature 031's mcp_servers).
  $VAR substitution helper factored to darnit.core.env_subst and
  reused by feature 025 exec / 031 MCP paths.
• No new runtime dependencies. No product-package modifications
  outside darnit-core, darnit-baseline, darnit-testchecks.

Migrations

• Attestation generator gains optional attestation_store kwarg;
  legacy output_path filesystem path is the default.
• DotProjectReader + DotProjectMapper accept an optional
  ProjectStateStore; unset means pre-feature filesystem read
  (backward-compat locked by test_backward_compat.py).
• Audit driver calls resolve_stores + close_all around each
  audit run.

Deferred (documented in tasks.md)

• T026: audit-cache module migration -- location semantics
  (system-tempdir + repo hash) need a separate design conversation.
• T022: DotProjectWriter refactor -- read seam is what US1 needs;
  write seam lands with T029's control-side integration.
• T028: bulk rewrite of existing reader/writer tests -- backward
  compat means they still pass unchanged.
• T040 / T041 / T044: fault-injection tests for project-store and
  report-store -- blocked on control-side integration / darnit audit cannot emit SARIF or Markdown from the CLI #341.

All follow the surface established in this PR.

Test plan

• 30 protocol / discovery / selection tests
• 7 US1 tests (mapper equivalence, isolation, lazy instantiation
  -- SC-002 + SC-004)
• 6 US2 tests (zero-config invariance + backward-compat -- SC-003)
• 5 US3 tests (entry-point discovery + TOML selection + error
  shapes)
• 6 US4 fault-injection tests (FR-011 + FR-012)
• 2 import-isolation guards (SC-008 + FR-017)
• Full workspace sweep: 2928 pass, 22 skip, 0 fail
• uv run ruff check . clean on touched files
• uv run python scripts/validate_sync.py --verbose clean
• git diff main..HEAD -- pyproject.toml packages/*/pyproject.toml
  adds no new [project.dependencies] entry (FR-014)

Plugin author guide at docs/plugin-authoring/stores.md includes a
worked S3-backed AttestationStore example.