warm-by-default: cache on by default with stat-proxy freshness

[tcballard]

Tracks execution of the warm-by-default roadmap (rac/roadmaps/warm-by-default.md), decided in ADR-112 (supersedes ADR-110).

Scope:

• Flip the persistent-cache posture from opt-in to opt-out on rac find, rac validate, and rac mcp: --cache becomes the default, with --no-cache and a RAC_NO_CACHE environment escape.
• Default freshness verification becomes the stat-proxy manifest scan (size + mtime_ns, content-confirm on stat mismatch — the ADR-105 S5 accepted-miss model). The full byte re-hash becomes opt-in via a new --verify flag on find and validate.
• New machinery: a persisted per-root freshness manifest (manifest/v1/{root_key}.fseg) so one-shot rac find runs verify freshness at stat cost instead of byte cost, reconstructing the corpus key byte-identically from cached per-file hashes.
• Hardening: default_cache_dir must degrade (never crash) in homeless/unwritable environments now that the cache is on by default.
• Byte-parity contract carried forward: default output identical to --no-cache across search, --decisions, --type, --tag, --explain, and validate's output formats, for every non-S5 corpus state; the S5 window is pinned by test and --verify restores the full-hash floor.
• Docs flip across docs/cli.md, docs/mcp.md, docs/shared-server.md, docs/scale.md.

Out of scope (remains in single-node-scale-residuals): sub-stat changed-set detection (git/fsmonitor fast path); seeding the MCP tracker's cold start from the persisted manifest is a recorded follow-on.