feat(infra): tmp partagé inter-projets géré par IdeA (handles opaques, leases, GC, projection sandbox) — #189 (QA verte)

- Domaine: port ManagedTempStore + modèle (handle opaque, kind Directory/File, état Active/Released, allocation/lease, expiry).
- Application: use cases Allocate/Resolve/Release/GcManagedTemp, horodatés via Clock.
- Infrastructure: impl FS FsManagedTempStore sous app_data_dir/managed-tmp (root global inter-projets, métadonnées par handle, GC des leases expirés/libérés).
- Exposition MCP contrôlée (ManagedTempToolProvider, catalogue) + câblage sandbox: les agents résolvent un handle au lieu d'inventer un path libre.
- Tests: application/infrastructure managed_temp.

crates/application/src/error.rs

@@ -10,7 +10,7 @@ use domain::ports::{
     ModelServerError, ProcessError, PtyError, RemoteError, RuntimeError, SecretStoreError,
     StoreError,
 };
-use domain::{AgentId, NodeId};
+use domain::{AgentId, ManagedTempError, NodeId};
 use domain::{IssueStoreError, SprintStoreError};
 
 /// Errors surfaced by application use cases.
@@ -178,6 +178,16 @@ impl From<ChatAttachmentStoreError> for AppError {
     }
 }
 
+impl From<ManagedTempError> for AppError {
+    fn from(e: ManagedTempError) -> Self {
+        match e {
+            ManagedTempError::NotFound => Self::NotFound("managed temp".to_owned()),
+            ManagedTempError::Invalid(message) => Self::Invalid(message),
+            ManagedTempError::Store(message) => Self::Store(message),
+        }
+    }
+}
+
 impl From<MemoryError> for AppError {
     fn from(e: MemoryError) -> Self {
         match e {