Task: Mop up the codegen snags the parts guard left

Delete the guard in generate.py that keeps the codegen graph out of a sub-component project's CMake. Every part's src/CMakeLists.txt and tests/CMakeLists.txt is generated from its model again, and the two files main hand-wrote against their templates are reconciled rather than reverted.

• The ores.cmake.* guard in generate.py is gone, and the graph renders a part's CMake the way it renders any other component's.
• Every component's link list is model-derived: the api, core and service src templates carry the baseline, and a component that deviates says so in extra_dependencies. No component's links change.
• ores.cmake.component.api_src and .core_src emit component_files.cmake rather than file(GLOB_RECURSE), completing the 2026-07-30 migration that 88 of the 94 checked-in files already follow.
• ores.geo's CMake is regenerated from its model, with the ores.database and ores.telemetry.core links its sources need, and the component builds.
• ores.history/api declares header_only, so its template emits the INTERFACE library it is hand-written as.
• compass check passes, whole-tree build and ctest included.

(Implementation strategy. Written when work starts; key decisions are distilled into the parent story's * Decisions at close, but the plan itself stays — it is the historical record of what we did.)

Every number this task claims about a tree, with the command that produced it and the commit it was measured at. A number without both is not a measurement, because a clean-up record describes a tree and trunk moves under a branch: a consumer count, a gate's component count and a suite's size all change with no code changing, and the reader of a bare number cannot tell which tree it came from. Where the raw output matters, put it in an evidence/ file beside the task and name that file in the Command column.

Work in progress on feature/mop-up-the-codegen-snags-the-parts-guard-left. The guard is lifted, the link libraries are modelled, and no src/CMakeLists.txt loses a link. It does not build yet, and the reason is the finding below.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

The parts declare their CMake in the model and the templates render it, so no part carries hand-maintained CMake any more. The CMake facet guard is gone: every part renders its own CMakeLists.txt.

The model gained:

• extra_dependencies and extra_test_dependencies on 50 components, carrying the hand file link block verbatim: the link sections, the visibility of each library, and the find_package calls that define the imported targets.
• cmake_prologue and cmake_finalize paste points on every src archetype and on both branches of the header-only ones, so a hand-written prologue and a hand-written install rule survive regeneration.
• #+component_kind: on 47 parts, #+test_fixture: none on ores.analytics/quant, #+win32_static_library: true on ores.trading/core, and :ores.cpp.service-app.enabled: nil on the 17 service parts that keep a hand-owned src/app, src/config and main.cpp.
• component_files.cmake for the five test directories the parts materialised.

Merged as 8a876fbda8: 356 files, 7083 insertions, 818 deletions, 11 commits.

The verification state is not a whole-tree build. CMake configure completed for all 5901 targets with no error, and git merge-tree reported no conflict with the main the PR merged into. Compilation reached object 980 of 5901 – ores.dq/api, ores.iam/api, ores.telemetry/core and ores.refdata/api – with no compile error, then stopped on request. The remaining 4921 objects never compiled, ./compass.sh check never ran, and the branch was 107 commits behind main when it merged.

The merge landed without a whole-tree build. Nothing else in this task remains, but the merge is unproven until that build runs. The four layers the hand part CMake carried are link lists, link visibility, find_package calls, and compiler options, includes and install rules. The first three are now modelled. The fourth still comes from the per-component paste points, so a part that hand-sets a compiler flag or an include directory keeps it by declaration, not by model.

The CMake content is now covered. Two paste points, cmake_prologue before the library target and cmake_finalize before its install rule, are in every src archetype and in both branches of the header-only ones. The seven places that lost content declare it, and ores.trading/core declares #+win32_static_library: true because its WIN32 STATIC choice replaces the template's add_library rather than adding to it.

What still stood in the way when the merge landed:

1. test_handler_permissions fails two tests on main: six permission codes are not seeded and the handlers added in c759acec1f reference them. Captured, and not caused by this branch.
2. The whole-tree build has not been run. It is the only thing that can prove the link lists, the compile options and the includes all still hold.
3. ores.telemetry/database lost two target_include_directories entries that are now redeclared; whether they were needed at all, given the linked targets, was not established.