feat(cli): validate --introduced reports only what your stage caused

[rennehan]

validate's verdict covers the resulting branch, not your change. On a branch that already carries findings — the normal state of a large imported graph — validate && commit is unusable however correct the change is, and a caller cannot tell "I broke this" from "it was already like this".

Measured on a real branch: an empty stage returns 99 findings and exit 5.

What it does

$ hydrate validate --introduced          # empty stage, 99 inherited findings
No new coherence findings from your staged change.
Valid: your change adds no coherence errors on branch 'cachetools-keyless-rt'.
exit 0

$ hydrate validate --introduced          # after staging one unwired input
1 coherence finding from your staged change:
  [error] unsatisfied_input  NeedsInput.feed: input port NeedsInput.feed has no incoming edge

2 coherence findings already on branch 'sweep-1', not caused by your change.
Invalid: your change adds 1 coherence error on branch 'sweep-1'.
exit 5

Both directions verified against the live service.

Fail-closed, because the errors aren't symmetric

• inherited misread as introduced → loud: a spurious non-zero exit, complained about the same day
• introduced misread as inherited → silent: it still prints, the verdict reads clean, the gate passes where today it stops

So anything ambiguous is classified introduced.

Identity

(code, raw locator), keyed before path resolution — resolution is presentation, can be partial, and a stale index can fold two ids onto one path.

Counted as a multiset, not a set. A locator legitimately carries more than one finding, so with a set a locator going from one finding to two registers as no change — hiding the new one, in the silent direction. Mutation-verified: switching to set semantics fails 7 tests.

The two calls must describe one branch

If the branch moved between the reads, the answers describe different graphs, and attributing across them would blame your stage for someone else's commit — or hide one of yours behind theirs. It refuses to partition and says so. A conservation check on the buckets does the same for a bug in this code. Mutation-verified: removing the version guard fails 2 tests.

JSON

Three buckets as separate arrays rather than one list with a flag, and valid is redefined to match the exit code, with the server's whole-branch answer under whole_branch_valid. Otherwise the most gateable field in the payload would disagree with the exit status beside it.

Default behaviour is unchanged — this ships behind the flag. Flipping the default is the follow-up, and that one changes what exit 5 means for existing callers.

419 tests. fmt, clippy -D warnings clean.