Give each command one pipeline across CLI, serve, MCP, and embedding #1002

Problem

Wright has two command pipelines:

• The CLI calls CompilerSession directly and applies essential::* per command (crates/wright-cli/src/main.rs).
• MCP and serve go through ToolService (crates/wright-driver/src/service/), which applies its own projections in service/refusal.rs.

Lint exists in both pipelines, and the two verdicts differ:

• ToolService::lint (service/mod.rs) sets ok: false and exit: 1 when any finding has error severity.
• CompilerSession::lint (session/semantic.rs) derives the verdict only from envelope diagnostics.

The --fail-on gate also lives in CLI presentation (present.rs, gate). So embedding and MCP callers cannot apply it, and it is a third place that decides exit.

Scope

• Give each operation one implementation and one projection that the CLI, serve, MCP and embedding all use.
• Move the --fail-on decision into the driver so that every surface produces the same verdict.

Non-goals

• Changing human-readable CLI wording.
• New commands or flags.

Needs decision

Which lint verdict is the contract, given that the two pipelines disagree on error-severity findings? Record that verdict in docs/agent-contract.md and docs/cli.md before implementation.

Acceptance criteria

• For one input and one lint configuration, wright lint --format json and the lint tool request return the same ok and exit, enforced by a sibling-agreement test.
• --fail-on is applied in the driver, and the agent contract exposes the equivalent behavior or documents its absence.
• No lint verdict logic remains in wright-cli.

Dependencies

Blocked by the typed-results sub-issue, because the driver-side gate needs typed severities.