0.9.0 — an answer that says what it stands on: store choice, honest counts, bounded answers

[RSafargalin]

Started as one bug and became a pass over every place the tool answered confidently without being
able to. It now carries release 0.9.0.

The bug it started with

On a project with agent worktrees the wrong index store was chosen: a worktree lives inside the
checkout, so its DerivedData passed the "inside the project" test, and being rebuilt more recently
it also won on freshness — after which the record filter rejected every path in it as foreign.

refs AbsAccountsViewModel        before: ⚠ 0 semantic hits → "a closure, a local, or another kind of symbol"
                                 after:  def: …/AbsAccountsViewModel.swift:16 · usages: 7 in 3 file(s)

Selection now applies the same scope predicate the record filter applies. The earlier note that this
"could not be reproduced by a test" was wrong: the test was broken, not the tool —
createSymbolicLink(at:withDestinationURL:) resolves a relative destination against the current
directory, so the rival store never existed on disk.

What grew out of it

Forty defects reproduced by running the tool, written down as tests that fail when the defect is
fixed, and closed. Highlights:

• Store choice is a person's decision. Several usable stores answer the same question
  differently (measured here: 83 references from one, 34 from another, 91 from both), so the tool
  refuses to guess and sextant store use recency|union|coverage records the choice. Every answer
  carries which store was read and why the others were not (ADR-0006).
• A units reader for libIndexStore (dlopen over a declared ABI subset) makes coverage
  measurable, so the trust label now says extent as well as freshness:
  [index: derivedData · 1 store(s) · fresh · covers 10337/12351 files (84%)].
• Counts stopped overstating. A reference written inside a macro was counted twice (81 against
  74 real occurrences); --limit rewrote the total instead of shortening the list; the internal cap
  of 1000 was printed as the whole count.
• A hierarchy pointed at call sites and called them definitions — timestamp(ofStore:) at line
  48, where it is called, while it is defined at 25.
• Limits degrade instead of refusing. map, api, search, lint on a large project used to
  answer "more files than the limit" and nothing else; they now read the limit and name what they
  did not (⚠ covered 4000 of 12351 file(s)).
• Compile flags gained a notion of time, and dead entries no longer survive a read (two
  databases on this machine held 75 of 75 and 72 of 73 entries for files deleted weeks earlier).
• The daemon's output capture could hang — draining ran on the global queue while the caller was
  blocked on the write, so a starved pool starved the reader. It hung this very PR's CI twice.

Why the minor version moves

The stability contract breaks in three places, all listed in the changelog: exit codes (an
unparsable pattern, an empty symbol, a single-dash flag, a missing --project, an unmatched
api --package now fail), --max-files (refusal → bounded answer, so code 1 → 0 on a large
project), and --json shapes (the degraded refs answer is an object; blast/hierarchy/context
return {"found": false} where they printed prose).

Verification

• 318 tests, make ci green, CI green on the runner.
• The battery of fixed defects re-run on five public repositories (Alamofire, swift-argument-parser,
  swift-numerics, swift-nio, swift-syntax) and on the reference project: 172 checks, zero failures.
  Two real defects were found that way and fixed here.
• Benchmarks re-measured for scenarios A and B at the same pinned commits; recipes re-run against
  Alamofire 0455bfb — three of twelve blocks had moved and were updated.
• Interface Builder is documented as out of scope (ADR-0007);
  the shared IndexStoreDB directory was measured and is not a defect — per-process databases are
  worse at every level of concurrency, and the stand is kept in docs/measurements.

After merge

Tag v0.9.0 on main (the release workflow checks it against Sextant.version), then update
Formula/sextant.rb from the block the workflow prints — the sha256 cannot exist before the
archive does.