feat: make repository reads alias-aware

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3

workplans/STATE-WP-0085-repository-lineage-preserving-rename.md

@@ -298,7 +298,7 @@ guarding, and full migration upgrade/downgrade. The full Python suite passes
 
 ```task
 id: STATE-WP-0085-T04
-status: todo
+status: done
 priority: high
 state_hub_task_id: "dcf7102e-ed7a-503e-bf78-db2149f72453"
 ```
@@ -331,6 +331,17 @@ Acceptance:
 - new bindings use the new slug while workplan and task UUIDs remain unchanged;
 - external stale references are named rather than silently rewritten.
 
+Implemented one protected-slug resolver and applied it across repository reads,
+dispatch, consistency/path binding, inbox routing, interface changes,
+work-record identifier migration, goals, capability and service catalogs, SBOM,
+token summaries, Fabric projection reads, and dashboard links. Repository
+responses expose requested/canonical slug, canonical-or-alias status, aliases,
+and named stale external projections. Historical message and interface values
+remain unchanged; new writes are canonicalized. An idempotent old-slug message
+replay is proven to persist once, while workplan/task UUIDs and repository FKs
+remain stable. Verification: 775 Python tests and the 70-page dashboard build
+pass (the build retains one pre-existing `/docs/intakes` broken-link warning).
+
 ## Add the State Hub CLI and HelixForge orchestration contract
 
 ```task