perf: memoize wiring plans on the registry, shared tree-wide

[lesnik512]

The WiringPlan memo lived on CacheItem, which is per-container, so a REQUEST-scoped Factory rebuilt an identical plan on every child container (measured: 101 WiringPlan.build calls across 100 request containers where 1 is correct), and validate()'s get_dependencies/iter_validation_issues rebuilt it unmemoized on every graph walk.

This moves the memo onto ProvidersRegistry — the object the plan is actually keyed to — behind a single plan_for(provider, build) accessor, keyed by provider_id and stamped with the registry version. Design rationale and the alternatives weighed live in the change bundle: planning/changes/2026-07-15.01-wiring-plan-registry-memo.md.

What changes

• ProvidersRegistry.plan_for — version-stamped, snapshot-before-build memo shared tree-wide (a container and every child share one registry), so a deeper-scope factory plans once per registry version, not once per child container. Distinct roots keep separate memos, so the same Factory in two registries with different provider sets wires independently.
• Factory._plan replaces _ensure_plan; the resolve path plus get_dependencies/iter_validation_issues all route through it, so validate() warms the memo instead of rebuilding on each walk.
• CacheItem loses wiring_plan/wiring_plan_version (5 fields → 3); uncached factories skip fetch_cache_item entirely.
• Invalidation is the version-stamped read-side check ported verbatim from CacheItem, preserving the resolve-vs-add_providers concurrency guarantee. No new lock — GIL-assuming, consistent with deferred.md A-1 (repointed to the registry location in this PR).

Behaviour and public API are unchanged.

Tests

• RED-first perf guard: a REQUEST-scoped Factory across 50 child containers asserts one build per provider (fails at 55 on old code, passes at 2). Replaces the weaker single-container count test.
• Correctness guard: same Factory, two registries, different provider sets → wires differently. Verified to fail under a naive version-only shared memo.
• Existing add_providers-rebuilds-stale-plan tests stay green as invalidation guards.

just test-ci (400 passed, 100% coverage), just lint-ci, and just bench (22 passed) all green.

🤖 Generated with Claude Code