Handle malformed and ambiguous lineage evidence conservatively

[iam-brain]

Question

Implement conservative family-level handling for malformed timestamps, missing or truncated parents, incomplete cumulative or latest totals, conflicting filename/metadata identities, ancestry cycles, and identity collisions, using the adversarial goldens and explicit debug diagnostics rather than fabricating or silently dropping usage.

Locked boundaries

A lineage graph is scoped to one normalized Codex home. sessions and sibling archived_sessions share that scope; separate Codex homes never merge, even when provider-account identity appears equal. Missing ancestry preserves deterministically unique descendant usage with incomplete provenance. Malformed or irrecoverable families may use containment indefinitely, but ordinary and known fork goldens must remain primary.

[iam-brain]

Implemented in stacked PR #32. The shadow ledger now scopes identity per Codex home, preserves degraded evidence, and routes ambiguous families exclusively through conservative containment.