feat: add keep-gates, graph E2E, watch bounds, and span joins

[AdityaVG13]

Summary

• run the Pattern-1 differential automatically when configured and require ast-grep 0.45.1
• compare literal:return file presence across the checked-in 13-language fixture with ripgrep 15.1.0
• preserve honest Not-run reporting when either external oracle is absent
• bound watch freshness at three debounce windows during sustained same-path writes
• ignore .asgrep and custom index artifacts before they enter the watch queue
• publish the indexed-source freshness policy through capabilities, robot guidance, and docs
• join pattern: and callers: conjunctions by overlapping span while preserving left-result identity
• keep other conjunction pairs file-scoped and apply AND NOT at the corresponding scope
• schedule a real pinned-Senpi graph E2E, fail hard on an absent or incomplete corpus, and retain its log as a CI artifact
• keep full ast-grep and ripgrep identity explicitly outside the bounded contracts

This PR is intentionally stacked on #31 because that PR owns the Pattern-1 harness and native nested-pattern implementation. Related gate, freshness, query-composition, and graph-scale work is consolidated here to avoid PR bloat.

Verification

• ASGREP_DIFF_AST_GREP=/opt/homebrew/bin/ast-grep cargo test -p ast-sgrep-core --test pattern_diff -- (5 passed, 0 ignored)
• ASGREP_DIFF_RG="$(command -v rg)" cargo test -p ast-sgrep-core --test literal_diff -- (1 passed, 0 ignored)
• python3 -m unittest scripts.tests.test_generate_compliance_report
• cargo fmt --all -- --check
• RCH cargo clippy -p ast-sgrep-cli --all-targets -- -D warnings
• RCH cargo clippy -p ast-sgrep-core --all-targets -- -D warnings
• RCH cargo test -p ast-sgrep-cli --lib watch::tests -- --nocapture (8 passed)
• RCH targeted machine-contract golden tests for capabilities and robot docs
• RCH cargo test -p ast-sgrep-cli --test watch_daemon_e2e -- --nocapture (2 passed)
• RCH cargo test -p ast-sgrep-core --lib search::conjunction::tests -- --nocapture (13 passed)
• RCH cargo test -p ast-sgrep-core --test conjunction_queries -- --nocapture (6 passed)
• RCH real pinned-corpus archived_pi_fixture_graph_modes_match_indexed_keys in release mode (1 passed)
• node --test tests/pi/launcher/*.test.mjs (23 passed after the Pattern-1 commit)
• yq eval '.' .github/workflows/graph-scale.yml
• real CLI E2E on tests/fixtures/pattern_diff: indexed one file and returned two structural process_request hits
• real CLI E2E on tests/lang/fixtures/extract: indexed all 13 files; literal:return and ripgrep returned the same file-presence set
• real watch baseline reproduced freshness starvation during sustained same-file overwrites; the regression now observes the token through a real CLI keyword search while writes are still arriving
• real CLI pattern/caller fixture returned only the target function with pattern, caller, and graph contributors
• real CLI pinned-Senpi index and searches returned definition, caller, graph, and import evidence with no indexing failures

Beads: ast-sgrep-o8ng, ast-sgrep-zxd9, ast-sgrep-o6i3, ast-sgrep-k1ns, ast-sgrep-mock-free-e2e-gaps-lbx1.5

Adversarial review remediation

• Prevented duplicate-name call-path edge splicing and downgraded SCIP occurrence evidence from exact resolution.
• Made pattern/caller joins require positional containment, including same-line and multiline-boundary cases.
• Made codemod source apply capability-relative and resistant to parent-symlink swaps; source apply and index refresh are documented as separate transactions with explicit recovery.
• Restored one-quiet-period watch debounce while preserving sustained-traffic maximum latency.
• Clarified that external ast-grep/ripgrep gates are opt-in, repository vocabulary widens semantic work, and unsupported performance comparisons are not product claims.
• Focused RCH evidence: conjunction unit suite 15 passed; watch unit suite 6 passed; real codemod CLI fixture and symlink regression 2 passed. Formatting and diff checks pass.
• Review fix and stacked sync head: f525fd22. CI was not awaited.