fix(cache): scope semantic cache writes to extracted files

[TPAteeq]

Summary

• Add an allowed_source_files boundary to save_semantic_cache.
• Prevent semantic results from replacing cache entries for files outside the dispatched extraction batch.
• Apply the boundary to both native CLI extraction and every generated agent workflow.
• Preserve out-of-scope nodes in the graph while skipping and warning about unsafe cache writes.
• Preserve backward compatibility for callers without an allowlist.

Validation

• 3117 passed, 30 skipped
• ruff check passed
• tools.skillgen --check passed
• Monolith round-trip validation passed
• graphify update . completed successfully

Closes #1757