Ratchet smells against pinned Hex packages

[dannote]

Summary

Add the CI-side corpus ratchet that complements Exograph's Hex-wide calibration.

Reach now runs its smell engine against checksum-pinned source snapshots of:

• Jason 1.4.5
• Plug 1.20.3
• Ecto 3.14.1
• Phoenix 1.8.9
• Decimal 3.1.1
• Gettext 1.0.2
• Floki 0.38.4
• Credo 1.7.19

Each package's canonical <relative-path>:<line> <kind> identities must exactly match its committed snapshot, so additions, removals, and location drift fail the default suite.

Source handling

• Prefer REACH_HEX_TARBALL_DIR / EXOGRAPH_TARBALL_DIR and the local /srv/toys/hex-mirror/tarballs snapshot.
• Fall back to Mix's existing Hex package cache.
• Download from Hex only when no local tarball exists, for portable CI and contributor environments.
• Verify every tarball against its pinned SHA-256.
• Extract only lib/**/*.ex; package code is never compiled or loaded.
• Cache extracted sources in GitHub Actions with a package-config-derived key.

Exograph remains the broad design-time calibration/index layer. The ratchet deliberately consumes the local source mirror and runs Reach itself, keeping semantic CI validation independent of the Exograph service.

Determinism

Repeated corpus runs exposed unstable grouped fixed_shape_map locations caused by project map iteration order. This PR sorts occurrence locations before selecting the finding location/evidence and adds a regression assertion.

Snapshot updates

Snapshots update only when explicitly requested with UPDATE_SMELL_CORPUS_SNAPSHOTS=1; normal tests compare without writing.

Validation

• MIX_ENV=test mix compile --warnings-as-errors
• mix test
• mix ci
• 990 tests passed, including 7 properties