fix(#323): the D1 guard had its polarity inverted — guard choosing, not naming

[ligon]

Follow-up to #635, which fixed the instrument but kept the wrong target.

The inversion

#635 bans reduce_to_agreed, collapse_to_cluster_grain, add_visit_level from core. But look at what those three do: they raise on disagreement, or blank the cell to <NA> and warn. None of them ever picks a winner. Core calling one cannot violate D1.

The construct that does choose — a bare groupby(...).first(), silently keeping one of two disagreeing observed values — was not guarded at all.

The guard forbade the safe tools and permitted the dangerous one.

This is not theoretical: implementing Option B (core using reduce_to_agreed in place of .first()) would have tripped #635 as a false positive — the same species of error as the original substring grep, one level up.

What replaces it

test_core_never_reduces_grain_without_auditing_it — a core function may use a raw pandas reducer only if it audits that reduction in the same function, while the pre-collapse frame still exists. One line later the evidence is gone; that is the whole lesson of #323.

All three current sites satisfy it:

site	reduces	audits
country.py::_collapse_to_cluster_grain	4536	4530
country.py::_normalize_dataframe_index	4680	4664
feature.py::_collapse_duplicate_index	142	127

That third site was not in #635s field of view at all.

Note the gradient this creates on purpose: rewrite a site to use a fail-loud helper and the raw reducer disappears, so no audit is required — nothing can be silently destroyed. Use the raw primitive and you must show your work.

test_core_does_not_read_an_aggregation_key — the actual Design-A wiring the name-ban was groping for. Twelve sweep branches proposed teaching core to read an aggregation: key; D1 rejected it. Core may mention the string (it sits in the _skip set so the key is ignored rather than mistaken for a column) but must never retrieve it.

test_the_reducers_are_not_yaml_dispatchable is kept, with its rationale corrected — it is not a D1 requirement. It is that these helpers are invoked explicitly from a countrys mapping.py, where the call is visible in review, rather than via a YAML string that is easy to add without one.

Verified in four directions

• green on development (22 passed);
• an unaudited groupby().first() injected into feature.py → reported;
• .get("aggregation") injected into country.py → reported;
• the Option-B shape (core calls reduce_to_agreed, raw reducer gone) → passes, where under fix(#323): the D1 guard checks coupling via AST, not a substring #635 it would have failed.

Tests only; no lsms_library/*.py touched. Unblocks Option B.