Stage 2.4: a Project State reader that hands out current versions on demand #1702

Written-by: Chief
Part of #1550, Stage 2. Fourth Stage 2 slice. Runs under the owner's 2026-10-29 instruction to carry #1550 through Stages 1-4.

Why

#1550 asks for "a shared context reader presents current relevant versions to Chief and ephemeral workers; do not indiscriminately inject all files into every context". Today every Bot that needs Project State reads the files itself with cat, gets no version stamp, and nothing tells it whether the copy it read is the one on main.

What to build

One host-side reader over the Project State files that already exist in the repository (PROJECT.md, ROADMAP.md, docs/governance.md, decisions/*.md, LESSONS.md):

• List: for the working folder of the session, return each Project State file with its path, byte size, a content hash and its last-modified time.
• Read one: return the content of exactly one named file, bounded (refuse with the size when it is too large to hand over whole).
• Nothing injected: the reader is a tool a Bot calls. It never runs on its own, never pushes text into a prompt, and never reads anything outside the Project State list.
• Stale copies are visible: the hash is what the caller compares with what it already had, so a Bot can say "I read decisions/x.md at hash abc1234" instead of "I read the decisions".

Read from the session's working folder. When that folder is not a repository, or the file is absent, answer with the reason — never a guess and never an empty string that reads as an empty document.

Acceptance

• Tests in core/test/ with a temp-directory fixture: list returns the files with stable hashes; reading one returns its bytes; a missing file reports absent; a file over the size bound reports too large with its size; a folder with no repository reports not a repository.
• The hash of an unchanged file is identical across calls; changing one byte changes it.
• No prompt, system message or context is modified by calling the reader — a test asserts the session context is untouched.
• npm run verify green at the tip (TZ=UTC); patches regenerated; a subsystem page updated or a valid Docs-not-needed: in both the branch commit and the PR body.
• PR body: Part of #1550, Fixes #<this issue>, Owner: Chief, Reviewer: Reviewer, checkpoint block.

Out of scope

No Project Assistant, no digest, no GitHub identity. No new configuration key: the working folder is already the session's.