refactor: consolidate file layout and break circular dependencies

- Move error-handling, git-manager, prompt-manager, queue-validation, and reporting into src/services/
- Delete src/constants.ts — relocate AGENT_VALIDATORS and MCP_AGENT_MAPPING into session-manager.ts alongside agent definitions
- Delete src/utils/output-formatter.ts — absorb filterJsonToolCalls and getAgentPrefix into ai/output-formatters.ts
- Extract ActivityLogger interface into src/types/activity-logger.ts to break temporal/ → services circular dependency
- Consolidate VulnType, ExploitationDecision into types/agents.ts and SessionMetadata into types/audit.ts
- Remove dead timingResults/costResults globals from utils/metrics.ts and all consumers

src/temporal/activities.ts

@@ -19,20 +19,21 @@ import { heartbeat, ApplicationFailure, Context } from '@temporalio/activity';
 import path from 'path';
 import fs from 'fs/promises';
 
-import { classifyErrorForTemporal, PentestError } from '../error-handling.js';
+import { classifyErrorForTemporal, PentestError } from '../services/error-handling.js';
 import { ErrorCode } from '../types/errors.js';
 import { getOrCreateContainer, getContainer, removeContainer } from '../services/container.js';
 import { ExploitationCheckerService } from '../services/exploitation-checker.js';
-import type { VulnType, ExploitationDecision } from '../queue-validation.js';
+import type { VulnType, ExploitationDecision } from '../services/queue-validation.js';
 import { AuditSession } from '../audit/index.js';
 import type { WorkflowSummary } from '../audit/workflow-logger.js';
 import type { AgentName } from '../types/agents.js';
 import { ALL_AGENTS } from '../types/agents.js';
 import type { AgentMetrics, ResumeState } from './shared.js';
-import { copyDeliverablesToAudit, type SessionMetadata, readJson, fileExists } from '../audit/utils.js';
-import { assembleFinalReport, injectModelIntoReport } from '../phases/reporting.js';
+import { copyDeliverablesToAudit, type SessionMetadata } from '../audit/utils.js';
+import { readJson, fileExists } from '../utils/file-io.js';
+import { assembleFinalReport, injectModelIntoReport } from '../services/reporting.js';
 import { AGENTS } from '../session-manager.js';
-import { executeGitCommandWithRetry } from '../utils/git-manager.js';
+import { executeGitCommandWithRetry } from '../services/git-manager.js';
 import type { ResumeAttempt } from '../audit/metrics-tracker.js';
 import { createActivityLogger } from './activity-logger.js';
 

src/temporal/activity-logger.ts

@@ -5,16 +5,7 @@
 // as published by the Free Software Foundation.
 
 import { Context } from '@temporalio/activity';
-
-/**
- * Logger interface for services called from Temporal activities.
- * Keeps services Temporal-agnostic while providing structured logging.
- */
-export interface ActivityLogger {
-  info(message: string, attrs?: Record<string, unknown>): void;
-  warn(message: string, attrs?: Record<string, unknown>): void;
-  error(message: string, attrs?: Record<string, unknown>): void;
-}
+import type { ActivityLogger } from '../types/activity-logger.js';
 
 /**
  * ActivityLogger backed by Temporal's Context.current().log.

src/temporal/client.ts

@@ -30,7 +30,7 @@ import { Connection, Client, WorkflowNotFoundError } from '@temporalio/client';
 import dotenv from 'dotenv';
 import { displaySplashScreen } from '../splash-screen.js';
 import { sanitizeHostname } from '../audit/utils.js';
-import { readJson, fileExists } from '../audit/utils.js';
+import { readJson, fileExists } from '../utils/file-io.js';
 import path from 'path';
 // Import types only - these don't pull in workflow runtime code
 import type { PipelineInput, PipelineState, PipelineProgress } from './shared.js';

src/temporal/shared.ts

@@ -1,6 +1,5 @@
 import { defineQuery } from '@temporalio/workflow';
 
-// Re-export AgentMetrics from central types location
 export type { AgentMetrics } from '../types/metrics.js';
 import type { AgentMetrics } from '../types/metrics.js';
 

src/temporal/workflows.ts

@@ -41,7 +41,7 @@ import {
   type AgentMetrics,
   type ResumeState,
 } from './shared.js';
-import type { VulnType } from '../queue-validation.js';
+import type { VulnType } from '../services/queue-validation.js';
 import type { AgentName } from '../types/agents.js';
 import { ALL_AGENTS } from '../types/agents.js';
 import { toWorkflowSummary } from './summary-mapper.js';