move the two item visitors to the queries they always were

forEachEmergingItem and forEachIncomingItem took a const FactoryState& and
touched no member of BuildingSystem: they read the state and the free geometry
helpers and nothing else. They are queries wearing a system's uniform, and their
one caller -- the renderer -- reached through getBuildings() to call them,
passing the state back in as an argument.

They move to FactoryQueries beside the rest of the read surface, and the renderer
calls them directly. With that, BuildingSystem answers no queries at all: its
const accessor on Simulation and on ArenaSimulation had no other user, so both
are gone. Nothing outside the command path can now reach the system.

No behaviour changes; the bodies move verbatim apart from two arrows in comments
that were non-ASCII.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ne3mejABZoLWKLh8fgpM3x

src/lib/sim/Simulation.h

@@ -120,7 +120,8 @@ public:
     // private and reachable only through Simulation::apply (the command
     // chokepoint) or, in tests, SimulationTestAccess — so production code cannot
     // mutate the factory outside the recorded command path (docs/replay_design.md).
-    const BuildingSystem& getBuildings() const;
+    // BuildingSystem has no const accessor: it answers no queries, so nothing outside
+    // the command path has a reason to reach it (FactoryQueries.h).
 
     // The factory's world data, for the free queries in FactoryQueries.h.
     const FactoryState&   getFactoryState() const;