feat: `vouch fsck` — deeper consistency checks than `doctor`

[plind-junior]

What you're trying to do

doctor/lint catch surface problems, but several bugs (#78 archived-claim
leakage, #80 missing bundle members) are symptoms of no systematic integrity
pass. I want a thorough checker.

ROADMAP 0.3 lists vouch fsck.

Acceptance

• Detects: orphaned embeddings, dangling supersede/contradict chains,
  decided-proposal ↔ artifact mismatches, index-vs-file drift.
• Reports each finding with object ids.
• --fix is explicitly out of scope for v1.