Add exact DNF count support

[MesTTo]

Adds exact count support for the feature-gated PathMap DNF evaluator.

The count path returns duplicate-eliminated cardinality without returning the final map. It avoids materializing a final union when there is only one non-empty clause, and extends that shortcut when non-empty clause outputs are proven disjoint. If disjoint count addition would overflow usize, it now returns a typed error instead of wrapping.

Depends on #97.

Validation:

• CARGO_HOME=/home/user/Dev/.cargo-isolated RUSTFLAGS='-C target-cpu=native -Awarnings' cargo +nightly test -p mork --features experimental_dnf path_dnf --lib
• CARGO_HOME=/home/user/Dev/.cargo-isolated RUSTFLAGS='-C target-cpu=native -Awarnings' cargo +nightly test -p mork --features experimental_dnf --lib
• CARGO_HOME=/home/user/Dev/.cargo-isolated RUSTFLAGS='-C target-cpu=native -Awarnings' cargo +nightly test -p mork --features experimental_dnf --tests
• rustfmt --check kernel/src/path_dnf.rs
• jscpd --reporters ai --min-lines 5 --min-tokens 50 kernel/src/path_dnf.rs

[MesTTo]

Folded into #95: the DNF line was one unit split as serialized rewrites of the same function bodies (each PR restructured the previous one's code), so it is now a single coherent feature-gated PR — the reference evaluator with instrumentation, differentially sealed against PathMap's fused zipper_merge_dnf, with the empty-clause convention divergence pinned. See #95.