Count mixed findings toward holdout metrics

[heznpc]

Summary

• preserve the concrete split membership for each validation finding
• count mixed calibration/holdout findings toward each included split instead of only a synthetic mixed bucket
• add regression coverage so holdout usefulness cannot be bypassed by mixed risk summaries

Debug evidence

• before: real corpus holdout risk decisions were absent because mixed risk summaries only counted under mixed
• after: real corpus holdout decisions include 12 surface-overlap findings and 6 risk-summary findings
• report load is unchanged: 29 report findings, 8.6 review items per 1,000 lines, 19.4 underlying risk findings per 1,000 lines

Verification

• npm test
• npm run validate:corpus
• node scripts/validate-corpus.mjs --manifest /tmp/rulemeter-real-corpus/manifest.json --format json --out /tmp/rulemeter-real-corpus/result.mixed-split-counts.no-text.json
• node scripts/validate-corpus.mjs --manifest /tmp/rulemeter-real-corpus/manifest.json --format json --strict --out /tmp/rulemeter-real-corpus/result.mixed-split-counts.strict.json exits 1 as expected
• npm run dogfood
• npm run pack:check
• npm run smoke:install
• npm audit --audit-level=high