fix(ingest-cli): admit-source stays idempotent after the raw source moves

[transitrix]

Summary

• findRaw() in both field-artefact.mjs and codex-artefact.mjs only searched _intake/inbox/ for the raw source. The first successful admit-source moves that raw file out of inbox (field: into _intake/processed/; codex: renamed into the artefact's own sources/ folder), so a later retry on the same converted markdown found nothing to hash — the source_hash duplicate check was silently skipped and a fresh artefact was minted on every re-run.
• findRaw() now also checks the post-move location for both routes. The subsequent move/snapshot step is skipped when the raw is already there, or (under --force) copied rather than re-moved, so a --force re-admit still produces a genuine second artefact without disturbing the one that already cites the first copy.
• Codex's snapshot filename now embeds the original basename stem (snapshot_<id>_<date>_<stem><ext>, still prefixed snapshot_ for the existing IG-2 assertion) so the fallback lookup has something to match on.
• Documents the behaviour in SKILL.md next to the existing source_hash dedup note.

Test plan

• New Part U in transitrix/skills/ingest/tests/test_ingest_integrity.py — retries admit-source on the same converted markdown without re-dropping the raw file, for both the field (DRAFT) and codex (LAW) routes; asserts the retry is skipped (not a second artefact) and that --force still mints a genuine duplicate.
• Manually drove the CLI end-to-end for both routes (no local Python interpreter available in this environment) — confirmed the retry is reported skipped with the existing artefact's id and no second file is minted, and that --force mints a second artefact while the first snapshot/processed file is left untouched.
• node scripts/check-notations.mjs — clean (findings present are all under gitignored .claude/worktrees/, unrelated to this change)