Stream cross-jurisdiction code search results (SSE)

Server-sent events. Fans out the search query to peregrine in each cell where the user has repos, streaming results per cell as they arrive. A failing cell emits an error frame; other cells are unaffected. Each repos entry is a storage ULID or a forge-qualified gh/owner/repo | et/owner/repo slug; a bare owner/repo is rejected. A slug outside the caller's repo directory (e.g. a public repo) is point-resolved through entire-core (max 100 such slugs per request) and routed to its placement cell (ENT-3636); the search service re-authorizes it fail-closed. A pin that cannot be resolved is excluded from the fan-out like any other unsearchable repo — the stream degrades scope, it does not abort.