refactor: share the cross-surface reads in the kernel, add the project progress route, tighten the import contracts

[JArmandoAnaya]

What

Moves logic that three surfaces each wrote for themselves into the kernel, closes the last reverse gap, and puts the thin packages under the import contracts.

• Promoted assets: the five copies of _promoted (CLI, MCP and three REST routes) become one DatasetService.promoted_asset_ids.
• Name-or-id resolution: ProjectService.resolve, InferenceConnectionService.resolve and ReleaseService.resolve replace the CLI and MCP resolvers. Each surface keeps only what is its own: the MCP malformed-id refusal, the CLI option types.
• Import contracts: wire, formats and preprocessing may not import a delivery package or a web/CLI/MCP framework, nor sqlalchemy directly; jobs and inference also may not import the external mcp package. Six contracts now.
• REST: GET /projects/{id}/progress returns the same counts as MCP's get_project progress.
• Docs: the machine-local operations (init, token, ingest, export) are recorded as having no REST route that takes a path, by design; backfill-thumbnails is recorded as a gap that takes no path.

Addresses finding 12 and the reverse gaps of #884; the tracker is left for a person to close.

Notes for review

• Observable behavior is unchanged: the resolvers keep the old order (an id first, then the name), the same errors, CLI exit codes and MCP envelopes. The new Raises: lines add PROJECT_NOT_FOUND to the published approve_batch and commit_video_import docs, so openapi.json and the generated client change.
• Not moved: the project pre-label loop in cli/projects.py and mcp/batches.py. The kernel cannot import visionset.inference, the two copies differ in progress output and error handling, and each is about ten lines. REST enqueues a job instead, and jobs/prelabel.py is the worker handler, so neither is a third copy.
• Not moved: cli/inference.py::_resolve returns an id without reading the connection; routing it through the kernel would add a read.

Verification

• Python suite: 4938 passed, 29 skipped (tests/examples excluded).
• ruff, mypy, lint-imports (6 contracts kept) and the ui-core type check are clean; the docs link and sidebar gates and the MCP tool-reference check pass.
• Each new contract was shown to fail on a temporary forbidden import, then restored.
• Frontend suites and scripts/check.sh were not run locally.