[M9] Define safe source edit and refactoring contracts

[Teakowa]

Parent: #10

Depends on: #56, #57

Planning status: provisional until the M8 v1 gate is complete.

Goal

Define a safe, source-oriented mutation boundary for tools and agents without exposing Wright's mutable compiler internals as a public API.

Scope

• Identify high-value transformations that can be expressed as validated source edits/refactorings.
• Define source-edit/result models with version/source identity, spans, preconditions, conflicts, and diagnostics.
• Evaluate symbol rename and other semantics-backed edits first; add broader transformations only with evidence.
• Ensure edits can be previewed/validated through the normal compiler/session pipeline before application.
• Define behavior for stale source versions and overlapping/conflicting edits.
• Keep raw HIR/WIR mutation internal unless a separate proven use case requires it.

Non-goals

• A general-purpose arbitrary AST mutation protocol.
• Letting agents bypass validation and write unchecked compiler structures.
• Implementing editor-specific WorkspaceEdit/LSP types in core.

Acceptance criteria

• At least the proven safe refactoring/edit workflows have structured source-oriented contracts.
• Proposed edits can be validated against source identity and compilation/semantic checks before application.
• Public mutation contracts do not freeze internal arena/IR layout.
• Unsupported/unsafe edits fail explicitly.

[Teakowa]

Delivered in commit 03115d9 (wright_driver::edit).

• Source-oriented edit model: SourceEdit (kind, source identity, range, replacement) and RenameRequest/renam\u200bsymbol\u200b — the first evidence-backed refactoring is whole-word symbol rename across declaration and references.
• validate_edit rejects stale source versions (edit-stale-source), invalid ranges (edit-invalid-range), unknown symbols (unknown-symbol), and compiled errors; the edited source is previewed after passing through the normal compiler pipeline.
• Raw HIR/WIR mutation is never public; unsupported/unsafe edits fail explicitly.
• Tests: rename rewrites declaration+references with word boundaries, stale identity rejected, unknown symbol rejected, pipeline validation passes.