refactor(public-safety): centralize compact identifier shapes

[BigDataDZ]

Summary

Centralizes the identical compact public-safe reference, compact token, and module-qualified surface regular expressions in loopx/public_safe_text.py. Reward Memory, Semantic Preference, Decision Context, and Material Lifecycle retain their existing field-level behavior and error messages while consuming the shared compiled patterns.

Also adds a focused ownership regression test that verifies the listed consumers share the owner objects and no longer restate the literals.

Delivery brief

• Goal/source: remove demonstrated duplicated identifier/surface-shape decisions in the named capability contracts.
• Current gap: identical regular expressions were independently compiled across the shared public-safe contract surfaces, allowing drift.
• Observable result: each migrated consumer aliases the canonical compiled pattern; validation semantics remain unchanged.
• Owning boundary: loopx/public_safe_text.py owns syntax shapes, while callers retain contract-specific policy and diagnostics.

Validation

• uv run --extra test pytest -q tests/control_plane/test_compact_identifier_shape_owner.py tests/capabilities/test_decision_context_packets.py tests/capabilities/test_decision_context_profile.py tests/capabilities/test_reward_memory_ingestion.py tests/test_reward_memory_pipeline.py — 61 passed
• uv run --extra test ruff check … — passed
• git diff --check — passed

Scope

• Changed surfaces: shared public-safe shape owner; Reward Memory, Semantic Preference, Decision Context, and Material Lifecycle Python contract validation.
• No frontend, CLI, permission, persistence, default-off, or authority behavior changes.
• Future-facing refactor pass: applied; this removes duplicate shape authority without changing validation behavior.

[BigDataDZ]

Closing this to avoid two competing copies of the same change.

The content is re-pushed under the account this work belongs to, rebased onto a7e6b826a, in #5351 — #5351

What changed between #5350 and #5351:

• Base moved from the original branch point to current main, which pulled in fix(public-safety): decide the local-path check in one owner #5296. That made decision_context/packets.py and material_lifecycle/_validation.py conflict; the resolution keeps fix(public-safety): decide the local-path check in one owner #5296's find_public_safe_local_path call and its comments verbatim and removes only the duplicated _TOKEN_RE literal in favour of the shared import. Both files stay at net line delta 0, which is what preserves the two project_registry_io census sites recorded for _validation.py.
• Validation re-ran on the rebased head and the numbers, including the 9 environment-caused failures in test_repository_change_window.py that reproduce identically on an unmodified worktree at a7e6b826a, are written into refactor(public-safety): centralize compact identifier shapes #5351's body.

No content differs otherwise: same 14 files, +116 −24, same owner exports and the same 3-test guard.