#1214 Allow an artifact to belong to more than one collection

[williamthorsen]

What

A library artifact can now belong to more than one collection: The vetted collections may overlap, and a collection outside the disposition scheme is now a plain bundle whose membership makes no claim about its members. Exclusivity remains only for the two dispositions that assert an absence: A standalone artifact belongs to no collection, and a triage artifact holds no vetted membership.

Why

Overlap is the normal case for collections a consumer composes: a curated set and a purpose-specific bundle naturally share members. The one-collection-per-artifact rule was never argued for -- it held by construction when the original collections were the values of one mutually exclusive status enum -- and it blocked the purpose-collection work planned in #885.

Details

🎉 Features

• The claim map holds every claim an artifact carries rather than the first: a vetted collection's closure check passes when a reached artifact holds any permitted claim, and defect messages name every disposition held.
• A plain bundle (a collection outside the disposition scheme) neither satisfies the coverage check nor conflicts with any disposition, so purpose bundles can claim triage or vetted artifacts freely.
• The double-claim defect narrowed to the two real contradictions: a standalone artifact claimed by any collection, and a triage artifact claimed by a vetted collection.
• The dispositions section of codeassembly-content-specification states the many-to-many model.

🧪 Tests

• Coverage tests exercise the legal overlaps (two vetted collections; a plain bundle alongside triage) and both contradictions.
• Closure tests exercise any-permitted-claim acceptance, multi-disposition defect messages, and an artifact carrying no claim.

Closes #1214

[github-actions]

Dependency audit

Production dependency audit passed.