Add truthful grouped chains artifact reuse

[TacoRocket]

Summary

• add default grouped chains artifact reuse with truthful live and reused source reporting
• surface explicit artifact reuse skip reasons and preserve status-aware Graph batch error kinds
• remove the shadow assignment scope field and shrink grouped runner command-contract duplication

Why

The grouped chains reuse path needed to stay fast without silently hiding stale local artifacts, and the post-review follow-ups tightened both operator truthfulness and the internal maintenance seams without changing the public command shape.

Validation

• python3 -m ruff check src/azurefox/config.py src/azurefox/models/chains.py src/azurefox/chains/registry.py src/azurefox/cli.py src/azurefox/chains/runner.py src/azurefox/clients/graph.py src/azurefox/collectors/provider.py tests/test_cli_smoke.py tests/test_collectors.py tests/test_graph_client.py
• PYTHONPATH=src python3 -m pytest -q tests/test_collectors.py -k "collect_permissions or permissions_current_identity or collect_role_trusts_uses_graph_batch_helpers_when_available" tests/test_graph_client.py
• PYTHONPATH=src python3 -m pytest -q tests/test_cli_smoke.py tests/test_output_writer.py tests/test_visibility_tiers.py tests/test_contract_schemas.py
• push guardrail: 425 passed, 2 deselected