fix(guard): close the two live holes in obligations (c) and (f) - #408

Batch 2 of the multi-persona review of REQ-GUARD-GATE-EVIDENCE-002. Both
fixes address a defect that was LIVE on main, and in both cases the previous
fix had closed the adjacent question.

(f) #385 defect (b): the sorry pattern was as narrow as the exemption

The first revision fixed the self-service `-- TODO` exemption (defect a) and
left the pattern untouched, so `:= by sorry`, `:= sorry`, `admit` and
`axiom cheat : 7 = 8` all reported zero — the four forms the issue named
explicitly. An author could assert a falsehood and the floor never moved.
Worse, the self-test contained a case ASSERTING that a non-bare occurrence
does not count, which made the hole look deliberate.

Detection now runs over comment-stripped text (nested `/- -/` and `--`),
which is what allows word-bounded patterns instead of line anchors: prose
mentioning sorry still does not count, and every real form does. `sorryAx`
is counted separately since `\bsorry\b` cannot see inside it.

MEASURED before widening: the count is 12 either way. The tree contains no
inline sorry, no admit, no axiom, no sorryAx today, so this is a pure
tightening with no floor change and no latent red. Output is now broken out
by kind, so a shift from `sorry` to `axiom` at a constant total is visible.

(c) #404: the filter gate parsed `-p` and then ignored it

`extract_filter` extracted the package; the vacuity test matched against a
flat workspace-wide inventory. So the gate asked "does this substring occur
anywhere?" while run_verification.py runs "does it occur in package P?" —
strictly weaker, and #388's own executed proof case survived it.
`cargo test -p spar-wasm -- topology` matches three tests, all in
spar-solver and spar-network.

The inventory is now collected per package and each filter judged against
its own. A package that cannot be inventoried is CANNOT-JUDGE (exit 2), not
a pass. `--inventory-json` now requires an object; a flat array is rejected
because a flat list cannot express which package owns a test, which is the
defect itself.

TEST-STPA-SVG-TOPOLOGY is demoted to `proposed` rather than repointed. Its
description claims eight tests covering labels and connection endpoints;
spar-wasm's nearest candidates are the four in `graph::tests`. The described
evidence cannot be located, and picking a filter that merely selects
something would assert a relevance nobody has checked.

Both suites mutation-tested, all mutants caught. Two needed the same fix as
check_mutants_report.py — pinning the DIAGNOSIS, not just the exit code —
because distinct broken inputs reach the same exit code by different routes,
so removing a guard left the suite green. That includes the exact mutant the
adversarial reviewer used to falsify the old mutation-testing claim:
`filt` -> `filt.split('::')[-1]`, which no case could see because none had a
`::` filter while 16 of 60 real ones do.

Closes #404. Refs #385 (defect b). REQ-GUARD-GATE-EVIDENCE-002 (c), (f).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Found by the per-package inventory the previous commit introduced — its
first contact with a real cargo workspace, and it failed closed as designed.

`crates/spar-cli/Cargo.toml` declares `name = "spar"`. There is no package
called `spar-cli` anywhere in the workspace, and four verification steps
said `cargo test -p spar-cli`:

    TEST-CLI          cargo test -p spar-cli
    VAL-VERIFY-001    cargo test -p spar-cli -- verify
    VAL-DIFF-001      cargo test -p spar-cli -- diff
    VAL-MCP-001       cargo test -p spar-cli -- mcp

cargo answers `error: package ID specification 'spar-cli' did not match any
packages`, so every one of those steps has always failed when actually run.
The old flat inventory never noticed because it never passed `-p` to cargo
at all — the same discarded-package defect as #404, showing up as a broken
reference rather than a mis-scoped one.

Rewritten to `-p spar`. The filters have candidates under crates/spar-cli/
(verify 24, diff 2, mcp 2), and three of the four are `proposed` in any case.

Also: a package cargo cannot resolve is now a finding ABOUT those artifacts
rather than a traceback. `collect_inventory` distinguishes "did not match any
packages" (omit it, let check() name each affected artifact and exit 2) from
any other cargo failure (still fatal — a broken build invalidates every
verdict, not one artifact's). A traceback names only the first offender;
this names all of them.

19 self-test cases, including one asserting the artifact and package are
named rather than merely exited on.

Refs #404. REQ-GUARD-GATE-EVIDENCE-002 (c).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>