CAP-1b: make an excluded source file visible to packet sufficiency

[TheGreenCedar]

Closes #1829. #1802 stays open — the polish items (report field, citation
loss_reason, readiness, MCP schema) remain, none of which change a verdict.

A packet could rest a proof-bearing claim on a file the index had deliberately
refused and still report Sufficient. agent/ contained zero references to
coverage_reason or exclusions.

The route that was open is not the one the issue named

An explicitly probed excluded path already caps: exact_path_probe_citation
mints eligible_for_sufficiency: Some(false), so it reaches
missing_exact_path_claims and the packet is already Partial.

The uncapped route is a required file-scoped citation, minted
Some(!explicit) at orchestrator.rs:3084, read straight off disk and never
probed. This is therefore driven by cited paths, not probe paths — the
probe-side fix, which is where I would have started, leaves it untouched.

Shaped after EV-78, with one deliberate inversion

Two cause enums joined by one total mapping in contracts — a producer cause for
what the lookup did, a consumer cause for what a reader may conclude — so packet
and readiness cannot drift, exactly as FreshnessUnknownCauseDto does.

The inversion is the whole asymmetry. Freshness treats a missing
observation as unknown-and-capping, because a check that did not run proves
nothing. Coverage must not: an empty observation list means no path was checked,
which is legitimate and must cap nothing. A failed lookup arrives as a per-path
NotEstablished instead of as an absence.

Copying freshness wholesale would make every packet that cites nothing
Partial. A reviewer pattern-matching on the precedent will ask for the
fresh_index_observation()-style opt-in helper and be wrong;
no_observations_cap_nothing pins it.

Two ways this could have silently done nothing

• Path matching. Exclusion rows store workspace-relative paths; citations
  carry absolute ones. A string compare — or normalize_path_key — matches on
  some platforms and never on others: plumbing complete, every test green, and
  nothing ever capping. It goes through same_workspace_path.
• Filtering instead of mapping. The observer returns exactly one observation
  per requested path, including on lookup failure. A producer that dropped
  unknown paths would be indistinguishable from one reporting them covered —
  the defect moved one layer up.

The follow-up filter is not optional

Capping flips terminally_sufficient false, which is precisely what opens
follow-up generation. The cap alone turns a packet that answered and stopped
into one that re-probes a permanently unindexable file every round. Leads arrive
from three sources, so they are filtered once after all three contribute — my
first attempt filtered only the first source and the test caught it.

Verification

Ten tests. The load-bearing ones:

• a_packet_resting_on_an_excluded_file_cannot_be_sufficient — asserts the
  control is Sufficient first, so it cannot pass vacuously. Removing the cap
  clause reproduces Sufficient over the excluded file while the gap text
  already says the index never read it.
• no_observations_cap_nothing — the EV-78 asymmetry.
• every_status_reaches_a_definite_verdict — fails if a status variant is
  added and absorbed into a permissive arm.
• an_unnamed_defect_is_still_unprovable — an Incomplete with no reason stays
  typed rather than defaulting to covered.
• an_excluded_file_is_never_offered_as_a_follow_up_lead.

cargo test --workspace, cargo clippy --workspace --all-targets,
cargo fmt --check, and the generalization lint are clean.

🤖 Generated with Claude Code