feat(infra): tmp partagé inter-projets géré par IdeA (handles opaques, leases, GC, projection sandbox) — #189 (QA verte)

- Domaine: port ManagedTempStore + modèle (handle opaque, kind Directory/File, état Active/Released, allocation/lease, expiry).
- Application: use cases Allocate/Resolve/Release/GcManagedTemp, horodatés via Clock.
- Infrastructure: impl FS FsManagedTempStore sous app_data_dir/managed-tmp (root global inter-projets, métadonnées par handle, GC des leases expirés/libérés).
- Exposition MCP contrôlée (ManagedTempToolProvider, catalogue) + câblage sandbox: les agents résolvent un handle au lieu d'inventer un path libre.
- Tests: application/infrastructure managed_temp.

crates/domain/src/ports.rs

@@ -45,6 +45,10 @@ use crate::issue::{
     Issue, IssueAttachment, IssueAttachmentId, IssueCarnet, IssueIndexEntry, IssueListFilter,
     IssueNumber, IssueRef, IssueVersion,
 };
+use crate::managed_temp::{
+    ManagedTempAllocation, ManagedTempError, ManagedTempGcReport, ManagedTempHandle,
+    ManagedTempLease,
+};
 use crate::markdown::MarkdownDoc;
 use crate::mcp_tool_permissions::ProjectMcpToolPermissions;
 use crate::memory::{Memory, MemoryIndexEntry, MemoryLink, MemorySlug};
@@ -1320,6 +1324,33 @@ pub trait ChatAttachmentStore: Send + Sync {
     ) -> Result<Vec<ChatAttachment>, ChatAttachmentStoreError>;
 }
 
+/// Store for IdeA-managed temporary allocations shared across projects.
+#[async_trait]
+pub trait ManagedTempStore: Send + Sync {
+    /// Allocates a new managed temporary file/directory.
+    async fn allocate(
+        &self,
+        allocation: ManagedTempAllocation,
+    ) -> Result<ManagedTempLease, ManagedTempError>;
+
+    /// Resolves an active handle and updates its last access timestamp.
+    async fn resolve(
+        &self,
+        handle: &ManagedTempHandle,
+        now_ms: u64,
+    ) -> Result<ManagedTempLease, ManagedTempError>;
+
+    /// Releases an allocation, making it eligible for GC.
+    async fn release(
+        &self,
+        handle: &ManagedTempHandle,
+        now_ms: u64,
+    ) -> Result<ManagedTempLease, ManagedTempError>;
+
+    /// Deletes released or expired allocations.
+    async fn gc(&self, now_ms: u64) -> Result<ManagedTempGcReport, ManagedTempError>;
+}
+
 /// Persistence port for project-scoped custom chat drafts.
 #[async_trait]
 pub trait ChatDraftStore: Send + Sync {