feat(curator): escalate unrepairable wikilinks into the Librarian pipeline

[nickroci]

Summary

Stacked on #11. When the deterministic post-write pass (scholar_prompt.repair_broken_wikilinks, added in #11) cannot resolve a broken wikilink, it now escalates the issue into the existing Librarian→Scholar pipeline instead of silently neutralising it. No new agent or role — the Librarian already restructures articles, so we just feed it the issue and tweak its prompt.

Flow / integration points:

• repair_queue.py (new) — process-global, thread-safe RepairQueue with the in-flight guard. enqueue / drain_pending / clear, fingerprint = (kind, file, target). Structured so other invariant types (over-cap dirs, bad frontmatter) plug in later; only broken_wikilink is wired.
• Detection — scholar_prompt.repair_broken_wikilinks gained an on_unresolved callback; scholar._escalate_unresolved_wikilink enqueues the task. An escalated link is left broken on disk (not neutralised) so it stays detectable until actually fixed; the no-callback path still neutralises (backward compat).
• Routing — librarian.scan drains pending tasks, renders a highest-priority <repair_tasks> block (librarian_prompt), and attaches the drained fingerprints to every packet it emits (incl. error/empty). The Librarian researches the target with its existing bm25/embedding/Read tools and proposes the right existing action (rewrite link / create target / remove).
• Clear — scholar.review collects incoming fingerprints before any work and clears them in a finally (after the repair re-detection pass). The scheduler also clears fingerprints of packets dropped on backpressure.

The guard (only guard, no max-attempts, no give-up): re-escalate on every detection while unfixed. The in-flight marker prevents two concurrent attempts for one issue: set on escalation, kept across the Librarian drain, released when the carrying review concludes. Within one review that carries fingerprint X and doesn't fix it, the repair pass re-detects X but the re-enqueue is suppressed (still in-flight), then the finally clears X — so no double-escalation in one review, and the next pass re-fires once the marker is gone.

Cross-model design + implementation review by Codex confirmed the marker lifecycle is race-free and identified the leak modes that are now closed (drain-then-error, backpressure drop, all-empty early return, neutralise-erases-signal).

Test plan

• uv run --frozen ruff check . && uv run --frozen ruff format --check .
• uv run --frozen pyright — 0 errors (1 pre-existing __main__.py warning, untouched)
• uv run --frozen pytest — 570 passed, 90.38% coverage (≥90%)
• duplicate-code pylint gate — 10.00/10, no findings
• New tests: unresolvable-link trigger, in-flight guard blocks concurrent duplicate, re-escalation after marker clears, all-empty/backpressure marker release, Librarian prompt + drain/attach routing

🤖 Generated with Claude Code