refactor(retrieval): the completion-report preferences run through the pipeline (milestone 456 step 3, #4905)

reply_preferences.completion_preferences was the last hand-written
rule search + record_retrieval + record_rule_surfaced triple outside the
pipeline. It is now REPORT_PREFERENCE, a RuleArm with kind="preference"
over COMPLETION_QUERY, read back as records rather than as lines.

- RuleArm gains `kind`. _ranked asks the ranker for that kind and drops
  anything else on the way out, before the row is logged.
- RuleResult gains `shown`, the (score, rule) pairs behind the lines, for
  callers that return records.
- RuleMoment.project_id may be None: logged as given, searched as
  `project_id or None`. report_preference rows keep their NULL project.
- Guards: reply_preferences now has 0 direct rule searches. The registry
  constant-source example moves from report_preference to preference_slot,
  the pipeline slot that records through a module constant.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_retrieval_registry.py

@@ -2,7 +2,7 @@
 
 WHY AST AND NOT GREP, demonstrated rather than asserted. Two of the sources in
 this system reach their recorder as `source=SOURCE` through a module-level
-constant — `wide_net` and `report_preference` — so a grep for `source="` finds
+constant — `wide_net` and `preference_slot` — so a grep for `source="` finds
 neither. A registry test built on that grep would pass while being blind to
 two arms, which is the narrowing #3191 warns about: a check that looks
 thorough and quietly covers less than it claims.
@@ -101,9 +101,15 @@ def test_the_extractor_finds_something() -> None:
 
 
 def test_the_extractor_resolves_the_constant_sources() -> None:
-    """The specific capability a grep would lose. See the module docstring."""
+    """The specific capability a grep would lose. See the module docstring.
+
+    `report_preference` was the second example until milestone 456 moved it
+    into the retrieval pipeline, where its source is a spec field; the
+    pipeline's reserved slot still records through a module constant, so it
+    carries the case instead.
+    """
     found, _ = call_sites()
-    for via_constant in ("wide_net", "report_preference"):
+    for via_constant in ("wide_net", "preference_slot"):
         assert via_constant in found, (
             f"{via_constant} reaches its recorder through a module constant; "
             f"an extractor that cannot resolve one is blind to it"