fix: reject citation and blob relation keys

[cursor]

Summary of changes

Closes the remaining review findings from #226 now that that PR is merged.

• Make WriteCitation and WriteBlob fail closed when callers pass relation keys such as cites, derives_from, supersedes, or invalidates (.strict() schemas + planner validation errors instead of silent drops).
• Extend effort-graph, CLI, and live GraphQL coverage for CreateEffort cite rejection, cross-Effort Citation/Blob links, same-Effort Finding cites, and relations reads where the source record is outside the Effort.
• Update the mirrored effort-modeling skill text and the stale Finding so they describe the current Citation, Blob, and CreateEffort behavior.

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• I added doc comments to any new public exports, and inline comments to any hard-to-understand areas
• My changes generate no new console errors locally
• If applicable, try to include a test that fails without this PR but passes with it

Does this introduce any non-backwards compatible changes?

• Yes
  • Callers that previously passed forbidden relation keys on Citation/Blob writes and relied on silent stripping will now get validation errors.
• No

Does this include any user config changes?

• Yes
  • If so, I have updated the relevant areas of documentation
• No