Constructive-modeling follow-ups from the Rust port review #263

Deferred post-cutover follow-up from the Rust port review; see PR #260 and tracking ticket #261 (plan map #248).

These are constructive-modeling items ("make illegal states unrepresentable") that the review deliberately deferred: the port's parity-pinned tests make them risky to touch pre-merge, and none of them is a live bug today with the current callers.

• ClonePlacement value for plan construction. prune_plan / reconcile_plan (lifecycle.rs:1783 / lifecycle.rs:2262) take root and locations parameters that must agree with each other, but the agreement is enforced only in prose — today's single caller derives both correctly. Params that must agree could disagree and mis-classify a clone (e.g. a healthy unrecorded clone classified as orphaned). Fix: bundle root/locations into a ClonePlacement value built by one constructor, and make the PrunePlan / PurgePlan / ReconcilePlan struct fields private so a plan can't be assembled from mis-matched parts. This is on the wf surface (devlaunch-core module architecture and data model #251 §7).
• Type the core-authored English currently living in reason: String (devlaunch-core module architecture and data model #251 §5):
  • B4 — workspace_clone stale-base reason is composed as prose in core and leaks a {:?} NamePart debug rendering into user-facing text.
  • B7 — Unsaved::CouldNotTell collapses 4 distinct causes into 1 string field, which can render empty.
  • B15 — RepointFailure::Unreadable carries a stringly reason; ConfigError::Malformed collapses "not TOML at all" vs "TOML with a wrong-typed field" (contra divergence row 8's granularity); default_branch uses "" as a sentinel for "unknown" instead of an Option/enum.
• JsonKind duplicated verbatim in devpod.rs:521 and metadata.rs:94, which forces a duplicate renderer downstream. The json leaf module is its natural home; move it there and use it from both sites.
• Stage name validation — Stage::new("set hostname") splits on space, so a stage name containing a space silently reports every stage as NotReached. Fix as a const-fn newtype so an invalid stage name fails at compile time (E0080) — the reviewer verified the const-fn approach compiles and fires.