feat(infra): tmp partagé inter-projets géré par IdeA (handles opaques, leases, GC, projection sandbox) — #189 (QA verte)

- Domaine: port ManagedTempStore + modèle (handle opaque, kind Directory/File, état Active/Released, allocation/lease, expiry).
- Application: use cases Allocate/Resolve/Release/GcManagedTemp, horodatés via Clock.
- Infrastructure: impl FS FsManagedTempStore sous app_data_dir/managed-tmp (root global inter-projets, métadonnées par handle, GC des leases expirés/libérés).
- Exposition MCP contrôlée (ManagedTempToolProvider, catalogue) + câblage sandbox: les agents résolvent un handle au lieu d'inventer un path libre.
- Tests: application/infrastructure managed_temp.

crates/application/src/lib.rs

@@ -24,6 +24,7 @@ pub mod git;
 pub mod health;
 pub mod issues;
 pub mod layout;
+pub mod managed_temp;
 pub mod mcp_tool_permissions;
 pub mod memory;
 pub mod model_server;
@@ -130,6 +131,12 @@ pub use layout::{
     RenameLayoutInput, SetActiveLayout, SetActiveLayoutInput, SetActiveLayoutOutput,
     SnapshotRunningAgents, SnapshotRunningAgentsInput, SnapshotRunningAgentsOutput, LAYOUTS_FILE,
 };
+pub use managed_temp::{
+    AllocateManagedTemp, AllocateManagedTempInput, AllocateManagedTempOutput, GcManagedTemp,
+    GcManagedTempOutput, ReleaseManagedTemp, ReleaseManagedTempInput, ReleaseManagedTempOutput,
+    ResolveManagedTemp, ResolveManagedTempInput, ResolveManagedTempOutput,
+    MANAGED_TEMP_DEFAULT_TTL_MS, MANAGED_TEMP_PURPOSE_MAX_CHARS,
+};
 pub use mcp_tool_permissions::{
     McpToolPermissionCatalogue, ReadMcpToolPermissions, ReadMcpToolPermissionsInput,
     ReadMcpToolPermissionsOutput, UpdateAgentMcpToolPermissions,