feat(infra): tmp partagé inter-projets géré par IdeA (handles opaques, leases, GC, projection sandbox) — #189 (QA verte)

- Domaine: port ManagedTempStore + modèle (handle opaque, kind Directory/File, état Active/Released, allocation/lease, expiry).
- Application: use cases Allocate/Resolve/Release/GcManagedTemp, horodatés via Clock.
- Infrastructure: impl FS FsManagedTempStore sous app_data_dir/managed-tmp (root global inter-projets, métadonnées par handle, GC des leases expirés/libérés).
- Exposition MCP contrôlée (ManagedTempToolProvider, catalogue) + câblage sandbox: les agents résolvent un handle au lieu d'inventer un path libre.
- Tests: application/infrastructure managed_temp.

crates/infrastructure/src/lib.rs

@@ -29,6 +29,7 @@ pub mod inspector;
 pub mod issues;
 pub mod lock;
 pub mod mailbox;
+pub mod managed_temp;
 pub mod model_catalogue;
 pub mod model_server;
 pub mod orchestrator;
@@ -75,6 +76,7 @@ pub use inspector::{
 pub use issues::{FsIssueNumberAllocator, FsIssueStore};
 pub use lock::{acquire_app_data_dir_lock, AppDataDirLock, AppDataDirLockError};
 pub use mailbox::InMemoryMailbox;
+pub use managed_temp::FsManagedTempStore;
 pub use model_catalogue::{
     EmbeddedCompatibilityMatrix, HttpProviderModelCatalogue, ProcessCliVersionReader,
 };
@@ -83,8 +85,9 @@ pub use model_server::{
     LocalManagedProcess,
 };
 pub use orchestrator::mcp::{
-    McpServer, MemoryTransport, StdioTransport, TemplateToolError, TemplateToolProvider,
-    TicketToolError, TicketToolProvider, ToolPolicyRegistry,
+    ManagedTempToolError, ManagedTempToolProvider, McpServer, MemoryTransport, StdioTransport,
+    TemplateToolError, TemplateToolProvider, TicketToolError, TicketToolProvider,
+    ToolPolicyRegistry,
 };
 pub use orchestrator::{
     process_request_file, FsOrchestratorWatcher, OrchestratorResponse, OrchestratorWatchHandle,