fix(sdl): report lock, trust-policy and import-provenance failures as sdl diagnostics

[doublewhy]

Summary

Module import resolution let bad declarations, lock records, policy files, directory imports and provenance values escape as raw ValidationError, RecursionError, yaml, UnicodeDecodeError or IsADirectoryError, and raes sdl resolve printed a traceback rendering the input value. This PR reports each as SDLParseError through the existing bounded renderer, naming the failing file or import and never rendering input values or OS error text. Only error types change; a valid root still gives a byte-identical lockfile.

Re-route: this PR used to say Refs #297; #1426 delivered #297's done-when, so the branch carries only the residual bug, #1580. verify-imports rendering belongs to #1552.

Requirement UIDs

• None. Module import resolution leaks raw exceptions for invalid declarations, lock records and policy files #1580 has no Requirements section.

Related Issues

Closes #1580

Merge order: after #1446 and #1480 (they edit module_registry/resolution.py and module_registry/__init__.py); we rebase this the moment they merge.

ADR Impact

• No ADR required. Follows ADR-053 (validation order), ADR-076 §4-§5, ADR-073 §5 and specs/sdl/diagnostics.md §2, §3, §7, §8.

Changes

Head a7a4ca90, dev base cf8b4308. Tests are in test_issue_1580_import_boundary_diagnostics.py (40 cases, default markers, lane canonical / test-shard); evidence: CI run 38353796486, green at this head, and for the captures a formal replay with no drift. With the packages from the dev base, 38 of 40 fail; the 2 passing are the (control) rows.

Done-when (verbatim)	Change (file:symbol)	Test
resolve_lock_records and raes sdl resolve report invalid root import declarations with the same code, pointer and range as parse_sdl_file, and reject the import sources and versions that parse_sdl_file cannot record as provenance. A valid root still gives a byte-identical lockfile.	module_registry/_lock_records.py:resolve_lock_records, _model_diagnostics.py:_import_declarations, _provenance_record	test_resolve_reports_invalid_declarations_like_parse, test_unrecordable_provenance_fails_alike_through_parse_and_resolve, test_valid_root_keeps_a_byte_identical_lockfile_and_parse_result (control)
An invalid locked: record, or a locked: chain that revisits a record, raises SDLParseError naming raes.lock.json. It does not raise ValidationError or RecursionError. Acyclic chains resolve as before.	resolution.py:_resolve_locked_import (loop; a revisit raises)	test_invalid_lock_record_names_the_lockfile_record_and_field, test_locked_import_cycles_are_typed_errors, test_acyclic_locked_chain_resolves_like_its_local_target (control)
An invalid, malformed, non-UTF-8 or directory raes.lock.json or raes-trust.yaml raises SDLParseError with the file as path and its name in the message, and never renders its values.	load_lockfile, load_trust_policy	test_invalid_policy_files_are_typed_errors_naming_the_file
An import that names a directory gets an SDLParseError naming the import, and an imported unit with a removed scoring section gets the root's ADR-073 message.	resolution.py:_resolve_local_import, _local_import_source; composition/_expand.py:_expand_one_import	test_directory_import_is_a_typed_error_naming_the_import, test_unreadable_import_is_a_typed_error_naming_the_import, the two test_*_removed_scoring_* tests
expand_sdl_modules called directly reports an invalid declaration as a field diagnostic.	composition/_expand.py:expand_sdl_modules	test_direct_expansion_reports_an_invalid_declaration_as_a_field_diagnostic
raes sdl resolve exits non-zero and prints no traceback for each of these, naming the failing file.	raes_cli/sdl.py	test_raes_sdl_resolve_reports_each_failure_without_a_traceback
Both research captures are republished.	capture-19de059e… (specification coverage), capture-526d5758… (formal validation), digest f7b42a16eff6	check_specification_coverage.py, check_formal_semantic_validation.py

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Completion command passes
• No coverage regression

uv run --project implementations/python --frozen --all-extras python -m pytest <new module> -q gave 40 passed. Together with 22 related test modules: 984 passed, 1 skipped; with -m integration, 5 passed. nox -s contracts, nox -s verify-fast-feedback -- --base-rev origin/dev, nox -s lint, make policy and nox -s docs-local passed. canonical / gate and sonar passed in run 38353796486 (checked now). Captures were recorded with python -m tools.research_capture record, each with its receipt.

Ground Control Checks

• Repository policy command passes
• Regression tests fail without the change (38 of 40 at the dev base; 5 when only the provenance error path is reverted). An independent review gates this draft.

Traceability

• IMPLEMENTS: raes/module_registry/{_lock_records,resolution,models,__init__}.py, raes/_model_diagnostics.py, raes/composition/{_expand,_provenance}.py, raes/_composition_provenance.py, raes_cli/sdl.py
• TESTS: implementations/python/tests/test_issue_1580_import_boundary_diagnostics.py

Checklist

• Code follows the project coding standards
• FM level classified if semantic change
• Published contract schemas regenerated if models changed
• PR title is a Conventional Commit (release-please derives the version and CHANGELOG.md from it)
• Architectural docs updated if applicable

FM0: structural validation and parse-error reporting only; no schema or model changed.

Documentation

Updated: docs/explain/sdl/parser.md (Error Types). Precedents: Cardelli 1997, Momot et al. 2016, King 2019, Becker et al. 2019, Dhall.