Add buildSingleVaultTool: one owner for the single-vault dispatch contract

[AlexMost]

Consolidates the explicit-vault dispatch contract (vault param, suffix-last description, resolver call) into buildSingleVaultTool for all nine single-vault tools; deletes buildMultiVaultTool's separator heuristic; lint-enforces the import boundary; adds builder-level VAULT_REQUIRED coverage through the registration gate.

What changed

• src/lib/single-vault-tool.ts (new) — the mirror of buildMultiVaultTool for the explicit-vault class. A discriminated spec union on semantic: the semantic: true variant resolves through resolveSemanticVault and types entry.backend as present, cast-free.
• Nine tools migrated — seven operations (read_notes, create_note, edit_note, read_daily, set_property, remove_property, get_note_links) and two semantic (get_similar_notes, find_duplicates). 27 hand-rolled repetitions of the vault param spread, suffix concatenation, and resolver call are gone.
• Uniform paragraph placement — both builders now append the dispatch block as the description's own final paragraph. describeMultiVault returns the bare block; the spec.description.includes('\n') separator heuristic is deleted.
• Two suffix-position fixes — create_note had prose after the vault contract text; get_note_links folded the suffix into a .join('\n') array element. Both now end their domain description before the builder appends. Words unchanged, position fixed.
• CI-enforced boundary — an ESLint no-restricted-imports override bans src/modules/** from importing lib/vault-param.js / lib/resolve-vault.js. Probed with the verbatim npm run lint.

No tool-contract change

Parameter names, error codes, and dispatch prose wording are untouched. All 14 registered tools/list descriptions were rendered whitespace-normalized against main and diffed word-wise: the only difference is create_note's repositioned overwrite sentence. The other 13 are word-identical.

Tests

108 files / 1 347 tests green (from 107 / 1 342). npm run lint, npm run typecheck, npm run build clean.

• test/lib/single-vault-tool.test.ts — builder behaviour through the registration gate (registerTool + callTool/expectToolError, per ADR-0015): VAULT_REQUIRED code and details, named-vault targeting, unknown-vault failure, single-vault fallthrough, vault advertisement, suffix placement, semantic readiness routing.
• test/lib/explicit-vault-prose.test.ts — pins the suffix as the final paragraph of all nine registered descriptions. Probed against main's create-note.ts, where it fails.
• The nine migrations needed zero edits to existing tests.

Change: openspec/changes/archive/2026-08-30-single-vault-dispatch-builder (verify + retrospective included).

Closes #111

🤖 Generated with Claude Code