perf(semantic-search): snapshot manifest partitions (#65)

## Summary

Hardens the per-run manifest snapshot layer so scans are pinned to the
manifest captured at index creation time. This protects the KV-only scan
path from accidentally falling back to a later live catalog read.

## Changes

- Add regression coverage for create-time manifest snapshot stability.
- Prove `scan` does not reread a changed live manifest after `create`.
- Assert the scanned job keeps the original snapshot fingerprint and
source revision.

## Call Stack

```text
ToolSearchIndex.create()
  -> listToolManifests() once
  -> partition manifests
  -> write index-manifest/v1/{runId}/{partition} to executor.cache

ToolSearchIndex.scan()
  -> read partition snapshot from executor.cache
  -> never call executor.tools.manifest()
  -> materialize jobs from the snapshot
```

## Tests

- `bun run --cwd packages/plugins/semantic-search test --
src/sdk/tool-search-index.test.ts`
- `bun run --cwd packages/plugins/semantic-search typecheck`
- `bunx oxfmt --check
packages/plugins/semantic-search/src/sdk/tool-search-index.test.ts`
- `bunx oxlint -c .oxlintrc.jsonc --deny-warnings
packages/plugins/semantic-search/src/sdk/tool-search-index.test.ts`

## Stack

Base: #64

<!-- stack:links:start -->
### [Stack](https://github.com/aryasaatvik/stack)

1. #63
2. #64
3. **#65** 👈 current
<!-- stack:links:end -->

Author: aryasaatvik

packages/plugins/semantic-search/src/sdk/tool-search-index.test.ts

@@ -1032,6 +1032,45 @@ describe("ToolSearchIndex manifest snapshot", () => {
     }),
   );
 
+  it.effect("scans the create-time manifest snapshot when the live manifest changes", () =>
+    Effect.gen(function* () {
+      const [tool] = makeTools(1);
+      expect(tool).toBeDefined();
+      if (tool === undefined) return;
+      let liveManifests = [manifestForTool(tool, "fp-at-create", "source-at-create")];
+      const counters = { manifest: 0 };
+      const executor: Pick<Executor, "tools" | "cache"> = {
+        tools: {
+          list: () => Effect.succeed([tool]),
+          manifest: () => {
+            counters.manifest++;
+            return Effect.succeed(liveManifests);
+          },
+          schema: () => Effect.succeed(null),
+        },
+        cache: makeMemoryCache(),
+      };
+      const base = makeBase(executor as Executor);
+
+      yield* create({ ...base, runId: "run-snapshot-stability", partitionCount: 1 });
+      liveManifests = [manifestForTool(tool, "fp-after-create", "source-after-create")];
+
+      const scanned = yield* scan({
+        ...base,
+        runId: "run-snapshot-stability",
+        partition: 0,
+        limit: 10,
+      });
+
+      expect(scanned).toMatchObject({ processed: 1, changed: 1, skipped: 0 });
+      expect(counters.manifest).toBe(1);
+      expect([...base.jobs.data.values()][0]).toMatchObject({
+        fingerprint: "fp-at-create",
+        sourceRevision: "source-at-create",
+      });
+    }),
+  );
+
   it.effect("fails the scan when the run snapshot is missing (no D1 fallback)", () =>
     Effect.gen(function* () {
       const { executor, counters } = makeCountingExecutor(makeTools(2));