feat: compile controlled destination variables

[tcballard]

What changed

• compile controlled destination components for {merchant}, {client}, {project}, {source-app}, {year}, {month}, and {year-month}
• give configured routes stable IDs and require structured model decisions to select an ID plus only that route's declared values
• normalize and render final folders in Swift; missing, generic, undeclared, duplicate, or path-shaped values stay in review or fail validation
• preserve fixed and YYYY / YYYY-MM routing through the existing generation path, then attach the validated compiled-rule identity in Swift
• constrain Apple's structured schema to the actual configured route IDs and controlled variable names
• align the plain-language rule-plan generator, rule saving, Ollama/OpenAI prompts, and README with the runtime contract
• add --reference-date YYYY-MM-DD so date-based live-evaluation expectations and model prompts can be reproduced after the corpus month has passed

Why

Plain-language plans could describe useful hierarchies such as Receipts/{merchant}/{year}, but the runtime previously had no safe contract for resolving those placeholders. This keeps interpretation with the model while making rule identity, accepted values, normalization, and the final filesystem path deterministic Swift policy.

The historical private corpus also embedded July date-folder expectations. Explicitly recording its reference date separates a real routing regression from the calendar simply moving into August.

Product impact

People can create merchant-, client-, project-, source-app-, and date-based folder hierarchies without literal placeholder folders or free-form model paths. Uncertain values remain visible for manual review. Existing fixed/date rules retain their prior behavior.

Validation

• swift test — 86 tests passed
• no-signing native Xcode build (app + Finder extension + Sparkle target) — passed
• focused real Apple Foundation Models receipt evaluation — 100% (folder, filename, tags), 0 generation/schema failures, 0 unsafe/invalid decisions
• pinned 12-case private-corpus run (--reference-date 2026-07-19) — PASS: 83.3% exact, 12/12 folders, 10/12 filenames, 12/12 tags, 2 expected abstentions, 0 generation/schema failures, and 0 unsafe/invalid decisions

Closes #40