feat: add offline Graphify snapshot importer

[shaggitza]

Summary

• add a strict, offline-only importer for pinned Graphify graph.json snapshots
• validate schema/version, source roots, node/edge provenance, identifiers, bounds, and file integrity with deterministic bounded failures
• record immutable import receipts without executing Graphify or wiring it into default analysis
• document the sandbox boundary, deferred adoption gates, and explicit non-goals

Scope

This is a bounded foundation for #110, not Graphify adoption. It imports already-produced local snapshots only. It does not install or execute Graphify, invoke external commands, add a dependency, expose CLI/default analyzer wiring, or promote inferred/community proximity into reachability evidence.

Actual isolated invocation, FastAPI semantic overlay, frozen-corpus calibration, performance measurement, and BUILD/ADOPT/HYBRID/STOP adjudication remain open behind the trusted #101 sandbox.

Validation

• 35 focused adapter tests passed
• Ruff format and lint passed
• strict mypy passed for all source files
• independent terminal review: PASS
• post-rebase integration review against current main: PASS

Advances #110