fix: preserve lexical owners in reference diagnostics

[iperev]

Summary

Preserve the originating source field when private requirement-source
admission rejects a dangling non-claim reference. The old diagnostic pointed
to a derived /references projection absent from the authored JSON and fell
back to the whole-document span.

• Model errors retain source, requirement, scenario or derivation identity.
• The codec resolves scenario and derivation identities in original wire order,
  reusing the existing requirement/profile ownership path.
• Reported paths remain minimized, including dynamic scenario value keys.
• Regression tests cover all five lexical owners, inherited profiles, reordered
  arrays, dotted identities, original byte/scalar coordinates, CRLF and repaired
  positive controls.

Proof

The final reference tests fail against the original production files: 20 codec
coordinate cases and four direct model-origin cases. Paired kernel tests and
targeted race tests pass after the repair. The separate dynamic-key test
detected and prevents a regression in the initial implementation.

Final committed local and provider gates must pass before merge. Independent
review is bounded to this diagnostic change and its protected observations.
The committed local npm run check passed at 92a23ad2, including 333 browser
tests. Four review lanes found no confirmed defect; root resolved their missing
RuleID-domain and original-source operands against the actual owners. Numeric
scenario IDs are rejected before reference resolution; no new path AST is needed.

Boundaries

No accepted-input, error-code, public CLI, source-v1, format-selection or
publication change is intended. This repairs a P9-06 coordinate case; it does
not complete P9-06 or authorize public source-v2 cutover. Research/design and
implementation-plan documents remain outside the product repository.

Retro

The original reference-closure error discarded its source origin. The initial
repair also showed why moving a route must preserve its existing redaction
projection, not only lookup. Both behaviors now have executable controls.

[iperev]

Post-merge correction: an additional whole-operation counterexample confirms
a remaining regression in this change. The registered local and provider gates
passed, but they did not cover this case.

With two valid scenarios named examples and other, each containing two
examples, ordinary Parse succeeds. With MaxExamples=3, the model correctly
returns example_budget_exceeded at its aggregate scenarios.examples path.
The new codec route mistakes the field name for the scenario identity and
selects /scenarios/0 instead of the entire collection. The same collection-span
oracle passes with the original production files and fails with the merged
files. The limit and error code remain correct; the source span is wrong.

The review excluded numeric-ID collisions correctly, but that proof omitted
field-name versus identity collisions. A follow-up must preserve all three
path roles without banning valid IDs. This affects the private source codec,
not a newly exposed public CLI. It is not fixed by this PR and has not been
included in a new registry release. The follow-up is recorded as REG-01;
implementation is paused at the user's requested post-merge boundary.

[iperev]

The REG-01 follow-up is now merged in PR #135 (319a619). Only quoted-identity model paths enter entity lookup; aggregate fields and numeric positions preserve their roles. Exact-occurrence controls and two isolated negative mutations close the positional oracle gap identified during review. Final local checks and all applicable exact-head PR checks passed before squash merge. This repairs the private diagnostic regression; it does not claim whole-program correctness or a new registry release.