feat(core): validate warning for dead renames overlay entries (#19)

[adworzynski]

Implements proposal 0002 (accepted in #26).

validate now surfaces dead renames: overlay entries — the last org overlay without a consistency check (policies has policy.dangling, relationships has relationship.overlay_dangling). A non-blocking renames.dangling warning is emitted per kind: rule entry that renamed no rule the active set actually materialized.

"Applies to a rule" is read from provenance, not id presence: a live rename stamps source.original_id/source.pack on the materialized rule, so the applied-rename set is recoverable as {(pack, original_id)} and an entry is dead iff (pack, from) is absent. Forward-looking entries (pack not yet active) are dead now and warned too — the deliberate parity choice with policy.dangling.

What changed

Implementation:

• RuleDef gains an additive source: dict = {} field, populated in _ruledef_from_doc (so load_definitions and definitions_from_closure, which delegates to it, both carry provenance that was previously discarded on load)
• validate._renames_checks(model, diags), called from validate_semantic beside _policy_checks; derives the applied-rename set from rule provenance and emits renames.dangling (warning) per dead kind: rule entry, inserted in (pack, from) order (byte-stable — make_envelope sorts by (scope, path, code), identical across these, so insertion order is the tiebreak)

Tests:

• e2e (tests/e2e/test_rename_overlay.py): live rename → no warning; forward-looking entry → one renames.dangling, exit 0; dead entry alongside a live one → only the dead one; two dead entries ordered by (pack, from)
• unit (tests/unit/test_renames_dangling.py): applied-set derivation from provenance (renamed vs un-renamed rules; id-presence is not the test); additive RuleDef.source population; ordering; no-manifest no-op

Docs (same PR):

• docs/reference/cli.md — renames.dangling added to the diagnostic-code examples
• docs/reference/manifest.md — a line under renames noting a dead entry is warned, not enforced, via validate

No surface/skill change (core diagnostic only). Additive: new advisory diagnostic code, no exit-code or schema_version change, no manifest-shape change. Does not move a binding decision (advisory consequence of decision 0007's overlay, as the proposal's Compatibility section records) — no decision record.

Proof

Objective half — full suite green (pytest -q): 358 passed.

Session evidence — none required (proposal §Proof: this is a core diagnostic with no surface/skill change and no new judgment; the plugins already teach validate as the repo-health verb). Real CLI drive on a lean-ux repo with a forward-looking rename of the not-yet-active open-agile-architecture:

$ ea validate --scope org
exit code: 0 | status: ok
[
  {
    "code": "renames.dangling",
    "message": "rename overlay entry open-agile-architecture:refs-resolve → oaa-refs-resolve applies to no active rule",
    "path": "ea.manifest.yaml",
    "severity": "warning"
  }
]

Non-blocking (exit 0 / status: ok), one warning naming pack/from/to.

Closes #19.