fix: fence native project inputs before legacy operations

[roodboi]

Native hack.project.json input could be ignored by legacy discovery, allowing an ancestor Compose project or a constructed legacy context to be selected and changed. This adds a shared input selector and refuses native or mixed authored inputs before legacy project operations.

Discovery stops at native markers even when malformed, future-version, nonregular or dangling, while preserving legacy .hack/.dev precedence. Registered name/ID lookup checks the exact stored root. Init, config, registration, env repair and domain migration/rollback check before effects and again at mutation boundaries; refused rollback preserves its recovery journal. Doctor now checks before global/runtime probes. Listing reports blocked registrations as unavailable, skips their legacy metadata, and continues with healthy peers.

The common legacy guard performs one strict marker check. Native input has stable human/JSON refusal codes; env get keeps empty stdout and its redacted error. Global config and explicit offline compilation remain available. This does not enable native execution or provide atomic admission against concurrent external edits; NC03 execution and NC04 locked adoption remain separate.

Validation:

• Fresh full typecheck, check/privacy and changed-test lint pass; independent integrated and final-diff review found no blockers.
• Current compiled CLI: 35 isolated cases passed, including startup/run/exec, init, config/env, Doctor and domain repair, JSON codes, ancestor fallback and unchanged files/runtime on refusal.
• Relocated compiler success, diagnostics, symbolic refs, explicit-file, missing-sidecar and no-state-write checks pass.
• Focused selection/config/registry/runtime-cache checks: 101 pass; migration/worktree checks: 69 pass; init/views/autoregistration checks: 44 pass; final selection/Doctor/env checks: 59 pass. These overlap and are not an aggregate total.
• Fresh full repository tests pass: 2,189 CLI tests, 68 skips, zero failures; DB tasks reused valid cache (2 tests). All ten hosted CI jobs and Graphite mergeability passed on exact head 0eafc44. The strict Doctor fixture redirects Bun cache files and retains its no-Hack-effect assertions.

Release intent: a safety correction for native-input recognition in the v5 candidate. Base: next. HACK-1220 remains in progress for full frozen-contract coverage and local configuration merge; this PR is a bounded integration slice.