fix: report a null provider when no R was resolved, and snapshot the descriptor

[eitsupi]

arf r resolve emitted a non-null provider even when resolved was false and target was null, which is wrong because provider names where the installation was located, and it broke the descriptor's contract that every key is present and null when it does not apply. It is now derived from the same condition that decides resolved, so the two cannot drift apart.

Nothing verified that contract mechanically. Per-field assertions say nothing about the fields they do not name, so a missing or extra key goes unnoticed; one omitted key was only caught by reading a diff. The descriptor is now snapshotted for the eight shapes it can take, alongside the existing assertions rather than in place of them: the assertions prove the wiring, the snapshots pin the shape.

Machine-dependent values are normalized in the test rather than through insta's redaction feature. Normalization replaces only non-null values, so a null still reads as null, preserving the distinction the contract depends on.

Two rounds of review then found the same class of problem in how a diagnostic's path was handled, both only reproducible on Windows CI:

A pattern that located paths inside a diagnostic message was asymmetric, letting a drive-letter path run past the message's trailing colon. Recognizing paths by shape is unreliable, so the pattern is gone: a message that names a path now substitutes the diagnostic's own path string directly.

The message and the path field also disagreed: the message spelled the path with ~ while path held the absolute one, so on Windows, where temporary directories sit under the user profile, substitution found nothing. A client also could not correlate the two fields, and ~ is unresolvable for a client that does not know whose home it refers to. The message is now built with the raw path, and masking moved to the human-facing renderer. Terminal output is unchanged.

Test plan

• cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test (all suites pass, 0 failed)
• Restoring the unconditional provider fails the unresolved test
• Adding a field to the descriptor fails the snapshots; omitting an always-present key fails them too, verified with the field assertion removed so the snapshot alone had to catch it
• The old path pattern fails the new cross-platform normalization test on its drive-letter case
• Disabling home masking fails the renderer's unit test
• arf r resolve against a broken config under the home directory returns the raw path in JSON while the terminal warning shows the masked one

🤖 Generated with Claude Code