refactor(tools): decompose oversized governance checkers into support packages

[doublewhy]

Plain-language summary

• Context: Final slice of turning the red dev Sonar quality gate green (mechanical slice: ci(sonar): clear the tools new-code violations and exempt false positives #1155; package modules: refactor: resolve sonar complexity and length violations in package modules #1156).
• Problem: Three governance checkers predate the 500-line policy and carry the remaining structural violations — files of 3,121 / 2,039 / 1,640 lines with functions up to 302 lines, cyclomatic complexity up to 70, and cognitive complexity up to 66.
• Fix: Decompose each checker into an import-stable entry point over a support package of focused modules, every module under the 500-line cap and every function under the strict thresholds. Pure restructuring — no validation rule changes.

Issue mapping

• Closes refactor(tools): decompose oversized governance checkers below the strict Sonar thresholds #1154
• Stacked on ci(sonar): clear the tools new-code violations and exempt false positives #1155 (this PR's base is 1152-sonar-mechanical-exemptions; it retargets to dev when ci(sonar): clear the tools new-code violations and exempt false positives #1155 merges and should be rebased then). Merge order: ci(sonar): clear the tools new-code violations and exempt false positives #1155 → this → the gate needs refactor: resolve sonar complexity and length violations in package modules #1156 too.

Summary

• tools/check_sdl_catalog_parity.py → tools/sdl_catalog_parity/: paths/regex constants, the ~1,080-line reference-edge expectation dict split at SDL-section boundaries into three parts with a merged-registry overlap guard, table dataclasses/parsers, expected-classification helpers (return-count fixes via lookup tables), typed-model traversal, and decomposed checks (_check_top_level complexity 23 → per-field/per-aspect helpers; _check_references 21 → five focused failure collectors).
• tools/check_specification_coverage.py → tools/specification_coverage/: closed key sets, shape/digest/JSON-pointer primitives (pointer walk restructured around a step function), the 417-line/complexity-94 _validate_protocol decomposed into per-section validators with a concepts sibling module, artifacts/implementation-surface validation with extracted digest and execution helpers, the 270-line/complexity-89 _validate_snapshot decomposed around a frozen context dataclass, and recompute_analysis (complexity 34) split into counting/summary/status helpers.
• tools/check_formal_semantic_validation.py → tools/formal_semantic_validation/: fifteen modules (types, shape, replay, claims, protocol, corpus, snapshot, analysis, loading, releases, baseline, retest, production, satisfiability, supplement loading). The complexity-70/302-line validate_satisfiability_analysis and complexity-42/7-return _validate_baseline_drift become staged pipelines of guarded helpers; the two 8-parameter snapshot validators take frozen scope dataclasses; evaluate and the remaining >3-return functions are restructured to ≤3 exits.
• Entry scripts keep their paths (nox invokes them by path) and their import surfaces (tests import tools.check_<name>), with explicit __all__ re-exports.

Test changes

Three monkeypatch sites in test_formal_semantic_validation.py patched replay_case, load_bounded_json_object, and subprocess.run through the old monolithic module; they now patch the consumer modules so each test still pins the behavior it proves. Notably, the historical-releases-never-replay-current-code guarantee now pins both replay consumers (_snapshot and _retest).

Compatibility

• No SDL field, schema, portable contract, CLI surface, or experiment surface changes; no validation rule changes.
• nox script invocation paths and all test-facing import names are unchanged.

Verification

• Equivalence: all three checkers produce byte-identical output and exit status on this repo before and after — including the formal checker's full offline integrity + replay pass (exit 0).
• nox -s tests: green (includes the 80-test formal-validation suite, 25-test parity suite, 13-test coverage suite, and the coverage gate).
• Ruff 0.15.9 format and lint clean across tools/.
• tools/check_repo_policy.py: pass.
• Every new module ≤ 500 lines; decomposed helpers hold to complexity ≤ 10, ≤ 100 lines, ≤ 3 returns, ≤ 7 parameters.

🤖 Generated with Claude Code

[doublewhy]

Note: this PR shows as merged because its commit was folded into #1155's branch (its base) — Sonar's per-PR gate kept #1155 red for mega-function findings that only this decomposition removes, so the two layers now ship as one tools-scoped PR whose own gate can go green. #1155 closes #1154.