refactor: resolve sonar complexity and length violations in package modules

[doublewhy]

Plain-language summary

• Context: Part of turning the red dev Sonar quality gate green (raes-strict fails on any new-code violation); the tools/ slice is PR ci(sonar): clear the tools new-code violations and exempt false positives #1155.
• Problem: Fifteen recently-touched package modules each carry one Sonar violation: two files exactly one line over the 500-line cap (S104), four functions over 100 lines (S138), and nine functions with cyclomatic complexity 11–13 against the 10 threshold.
• Fix: Behavior-preserving extractions only — named helpers for oversized/complex functions, and three cohesive sibling modules for the file-length violations.

Issue mapping

• Closes refactor: resolve Sonar complexity and length violations in recently touched package modules #1153
• Companion slices: ci(sonar): clear mechanical new-code violations in tools and exempt false positives #1152 (tools mechanical, PR ci(sonar): clear the tools new-code violations and exempt false positives #1155) and refactor(tools): decompose oversized governance checkers below the strict Sonar thresholds #1154 (tools structural decomposition). The gate turns green when all three land.

Summary

• raes/composition/_expand.py: per-import provenance assembly moves into _import_provenance_additions.
• raes/phase_contracts.py: the two constraint-pointer shape predicates hoist out of _validate_constraint.
• raes_backend_libvirt/capability_envelope.py: the operating-system identity probe splits out of _out_of_envelope_terms.
• raes_backend_protocols/provisioner_capabilities.py: operating-system row and artifact-kind validation extract to module helpers (mirroring the existing _validate_account_support pattern).
• raes_backend_stubs/stubs.py: the operations fold extracts from apply into _applied_entries.
• raes_conformance/conformance/snapshot_semantics.py: entry and disclosure builders extract from _snapshot_from_envelope.
• raes_contracts/apparatus.py, contracts/capabilities.py, realization_envelope_carrier.py: validator bodies split into focused helper functions.
• raes_contracts/contracts/bundle.py (501 → 413 lines): _runtime_schema_bundle and its imports move to new contracts/bundle_runtime.py.
• raes_processor/planner/operations.py: ordered apply/delete op builders extract from _build_provisioning_plan.
• raes_processor/semantics/realization_runtime_evaluation.py: the observation-corroboration predicate hoists out of _corroboration_diagnostic.
• raes_runtime/backend_calls.py (501 → 438 lines): the seven ApplyResult shape validators move to new backend_call_contracts.py.
• raes_runtime/control_plane_api_participant_retrieval.py: the three governed-view routes fold onto one shared resolve/audit flow (_resolved_governed_view), removing triplicated logic while landing under the length threshold.
• raes_runtime/control_plane_store.py (→ 430 lines): snapshot payload builders move to new control_plane_store_payloads.py — this also keeps the file under the repo's own 500-line policy cap, which tools/check_repo_policy.py enforces.

Compatibility

• No SDL field, schema, portable contract, CLI surface, or experiment surface changes.
• The published schema bundle is verified byte-identical (tools/check_generated_schemas.py) despite the bundle.py split.
• All moved functions are module-private; the test-imported surfaces of backend_calls (_call_backend_apply, _RealizationApplyContext, _call_backend_diagnostics) are untouched.

Verification

• nox -s tests: 7,005 passed, 1 skipped; branch-aware coverage gate green.
• tools/check_generated_schemas.py: schema bundle identical.
• tools/check_repo_policy.py: pass (including the 500-line source-file policy).
• Ruff 0.15.9 format and lint clean across packages/.

🤖 Generated with Claude Code