…op + 7 route wires + snapshot v5

Deliverable A — KR-PROMOTE-SNAPSHOT-EXPAND (2nd promotion loop):
* New ``kora_cli/promote/snapshot_expand/`` (observer / proposer /
  applier / cycle). Reads ``reasoning.tool_called`` audit rows,
  clusters by tool_name, proposes new snapshot fields whose
  collector would have answered the same questions at $0 LLM cost.
* Audit seam ``promotion.snapshot_field_added`` (one row per
  proposal; ``action`` ∈ {``proposed``, ``auto_applied``}).
* Listener registers a daily cycle on the heartbeat scheduler.
* Auto-apply OFF by default per STOP-ASK §4 (schema mutation at
  runtime is fragile) — operator flips
  ``KORA_PROMOTE_SNAPSHOT_EXPAND_AUTO_APPLY=true`` once trust
  built. v1 auto-apply path persists a stub record only; it does
  NOT mutate ``state_snapshot.py``.

Deliverables B–H — cost-telemetry route wires:
* Extended ``MessageSource`` Literal in
  ``kora_cli/reasoning/engine.py`` with the four remaining
  reserved sources (``alert_investigation`` /
  ``email_outbound_compose`` / ``scheduled_task``;
  ``probe_investigation`` was already present).
* Extended ``_record_call_to_telemetry`` (bypass path) +
  ``_SOURCE_TO_ROUTE`` (gateway-route-through path) so every
  source value bills under its canonical route. Notably fixes
  ``probe_investigation`` previously falling through to
  ROUTE_UNKNOWN despite the wake_consumer setting that source.
* ``tool_loop_iteration`` (F) was already wired via the
  iteration ≥2 check; route mapping confirmation added to tests.
* Plugin audit cost tag (H): confirmed
  ``kora_hermes_plugin/audit/plugin.py`` reads ``route`` from
  kwargs + propagates to structured logs — no code change
  needed; behavior validated in the gateway route-through path.

Deliverable I — KR-SNAPSHOT-TASKS (v5):
* Bumped ``SCHEMA_VERSION`` 4 → 5.
* ``_collect_tasks`` now reads from a module-level cache
  populated by ``maybe_refresh_tasks_cache``, called from
  ``run_snapshot_cycle`` on a 30-min throttle (every 6th tick at
  the default 5-min snapshot cadence). Preserves the $0-LLM
  premise — the substrate read is one indexed SELECT but it
  crosses the gateway-to-substrate boundary so we cap frequency.
* Failed-provider refresh preserves prior cached values (so a
  flapping provider doesn't blank the panel).

FE TS type update:
* ``web/src/lib/api.ts`` ``SnapshotResponse.tasks`` comment block
  bumped to v5 with the populated-not-stub annotation. Existing
  types already cover the populated shape.

Tests:
* 19 new tests under ``tests/kora_cli/promote/snapshot_expand/``
  (observer / proposer / applier + cycle).
* 7 new tests for the route-mapping extension in
  ``test_anthropic_engine_router.py`` + 4 added parametrize
  cases in ``test_kora_hermes_plugin.py``.
* 5 new tests for the v5 tasks cache (refresh / throttle /
  provider-None / provider-error preserves-prior).
* Existing schema-pin tests at v4 / v2 relaxed to ``>=`` so
  future bumps don't recreate the same churn.

All 19 snapshot_expand tests pass; 21/21 router tests; 26/26
cost-telemetry tests. Combined daily cost ceiling for the two
promotion loops is well under $0.01/day (snapshot-expand is
fully lexical, $0; phrasebook averages ≤$0.005/day per its own
PR estimate).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>