Add Axiom input concept-coverage diagnostics

[MaxGhenis]

Summary

Add a shared input concept-coverage diagnostic with Belgium as its first real-runtime example. This is groundwork for consumer-owned Chronicle-to-Axiom mappings and explicit microdata requirements, not a completed concordance or a population schema.

• Add an optional input-inventory protocol without expanding the required RulesEngine interface. The Axiom adapter compiles fresh programs and records the runtime's canonical input addresses, accepted owners, and per-entity discovery counts.
• Preserve unavailable semantics as null. Explicit dataset bindings assess column presence only; extra demographic, wealth, predictor, and future-reform fields remain permitted. No name matching or inferred observed/imputed status.
• Preserve source facts and consumer assertions separately. Bindings pin source/runtime content and native entity context, carry source/target scope and evidence, and distinguish stocks from flows and income years from assessment years. Effective semantic relationships remain unresolved in v0, even for an authored exact assertion.
• Add a closed, self-validating, canonically hashed JSON diagnostic and CLI. The Belgian snapshot comes from real Axiom compilation: seven Person inputs, Household discovery unassessed with a null count, no dataset, and no source bindings.

Review and validation

• Fable reviewed the frozen design. Its six safeguards were incorporated: artifact pins, canonical identity/collision checks, separate asserted/effective relationships, measurement-scope guards, explicit discovery failure states, and deterministic hashing. Missing semantics result in unresolved, not an inferred proxy.
• Independent code review found two defects: native-entity context replay and false column presence from stringified labels. Both have tests-first repairs and clean independent re-verification, including real two-entity Axiom compilation and actual Frame label checks.
• Full frame plus concept-diagnostic test suite: 319 passed, 25 skipped. Optional integration skips remain explicit; this is not a claim that every engine integration runs in ordinary PR CI.
• Whole-repository Ruff, changed-file formatting, the 314-file CI test inventory, and diff whitespace checks pass.
• Two real CLI runs produced byte-identical Belgian snapshots. Source/native-wheel pins and the native build's local-crate lock-version correction are documented beside the snapshot; this is not an attested binary build.

Boundaries

The snapshot's content SHA-256 is 8b6c379afbf21e590c259722207ea07e41043be6ef335b6f77fed9a49b553086. Its producer-code fingerprints describe this dated source snapshot, not a released package.

This does not author or modify Chronicle facts, add Belgian wealth-stock targets, evaluate tax liabilities, activate calibration, publish microdata, certify a population, or complete the engine's typed-input contract. Runtime inputs can also be configuration or derived supplies, so the inventory must not be treated as a list of observed microdata columns.

The diagnostic is unsigned and always records certified=false and population_schema_ready=false. Real semantic equivalence, typed input metadata, and evidence-bearing Chronicle bindings remain follow-up work. The engine-side metadata work is tracked in axiom-rules-engine #62.