fix(core): parallelize PreToolUse hooks, backfill extraction, dedupe MAGE mapping

[bug-ops]

Summary

Three independent architecture-review findings in crates/zeph-core/src/agent/, all P2, no dependencies between them, filed by the same review pass and grouped into one PR.

• PreToolUse hooks fire sequentially per tier, unlike the already-fixed PostToolUse twin (#6128) #6259 — build_tier_call_futures fired each tier's PreToolUse hooks sequentially, adding N x hook_latency of purely serial blocking on the agent turn loop before the tier's already-parallelized tool execution even began — the same defect class already fixed for the PostToolUse side (tier_loop: apply_tier_results serializes RuntimeLayer/PostToolUse hooks per tool result within a tier #6128) but never mirrored to PreToolUse. Hooks now fire concurrently (Phase 1, bounded by the tier semaphore) before the sequential gate-check loop (Phase 2), mirroring the tier_loop: apply_tier_results serializes RuntimeLayer/PostToolUse hooks per tool result within a tier #6128 pattern. The per-idx ordering invariant (a call's own hook fires before that call's own gate check) is preserved structurally since Phase 1 fully completes before Phase 2 starts; there is no ordering requirement across different idx values.
• graph_backfill processes messages strictly sequentially despite store's per-entity locking making concurrent extraction safe #6261 — AgentAccess::graph_backfill extracted entities/edges from each unprocessed message strictly sequentially (one LLM call plus SQLite/Qdrant write at a time), despite the store's DB-level UNIQUE(canonical_name, entity_type) + ON CONFLICT ... RETURNING id upsert already making concurrent extraction across messages safe. Replaced with futures::stream::iter(...).buffer_unordered(4), matching the existing semantic_scan_plugin_add pattern/bound exactly — cuts backfill wall time roughly 4x with no correctness change.
• begin_turn re-derives MAGE signal type from raw u8 code instead of matching RiskSignal enum #6272 — Agent::begin_turn re-derived the MAGE (AuditSignalType, Severity) pair from the raw trajectory-signal u8 code via an independent hand-rolled match, duplicating the code-to-meaning table already authoritative in RiskSignal::from_code — the two tables were not compiler-coupled and could silently drift. Now matches on the already-computed RiskSignal enum value instead, removing the second magic-number table. Pure refactor, zero behavior change (exhaustively verified against RiskSignal::from_code's full variant set).

Review notes

A review pass caught a factually incorrect safety comment introduced for #6261: the original comment attributed graph_backfill's concurrency safety to EntityResolver::lock_name, but extract_and_store builds a fresh EntityResolver (and a fresh, empty name_locks map) per call, so lock_name never spans the 4 concurrent calls in a batch. The comment now correctly cites the DB-level UNIQUE constraint + ON CONFLICT upsert as the actual safety mechanism. graph_backfill passes embedding_store=None, so the one non-transactional path (Qdrant fuzzy match) is skipped entirely for backfill.

Test plan

• New regression tests: pre_tool_use_concurrency_tests.rs (timing-based concurrency proof + per-idx isolation test for PreToolUse hooks fire sequentially per tier, unlike the already-fixed PostToolUse twin (#6128) #6259), graph_backfill_concurrent_extraction_aggregates_stats_without_dropping_results + graph_backfill_concurrent_extraction_survives_real_sqlite_write_contention (real file-backed SQLite, WAL + busy_timeout, 8 messages exceeding the concurrency bound, for graph_backfill processes messages strictly sequentially despite store's per-entity locking making concurrent extraction safe #6261), mage_signal_mapping_tests.rs (pins the exact old-vs-new mapping for begin_turn re-derives MAGE signal type from raw u8 code instead of matching RiskSignal enum #6272).
• cargo +nightly fmt --check — clean
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings — clean
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins — 13717 passed, 0 failed, 34 skipped
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler" — clean
• gitleaks protect --staged — no leaks
• .local/testing/coverage-status.md updated (existing rows for PreToolUse hooks fire sequentially per tier, unlike the already-fixed PostToolUse twin (#6128) #6259/begin_turn re-derives MAGE signal type from raw u8 code instead of matching RiskSignal enum #6272, new row for graph_backfill processes messages strictly sequentially despite store's per-entity locking making concurrent extraction safe #6261)
• CHANGELOG.md updated

Closes #6259
Closes #6261
Closes #6272