chore(contracts): CHAOS-5720 Re-derive the ACR contract mirror for the organization-scope basis

[chrisgeo]

Ticket: CHAOS-5720

TEST-EVIDENCE

Re-derives the ACR contract mirror so this workbench accepts the refusal basis organization_scope_unsupported that the producer now serves.

refusal_basis gains a 6th closed-vocabulary member. The producer serves it when a question makes the organization itself the subject and asks for something other than a count, and it ends without a committed subject. The result carries the basis's own fixed sentence, which says organization-wide analysis of status, health or drivers is not supported and organization-wide counts are. On the prior pin, a response carrying the value is rejected as acr_contract_violation at /refusal_basis and /completeness/refusal_basis.

Branch chore/5720-org-scope-basis-mirror off main 2b8e70d7, 3 commits, all signed (tip f84efea301c7511b09020e2c5f9697d9bb12864d). Every command below was executed in this worktree after a real pnpm install --frozen-lockfile (rc=0; node_modules installed, not linked).

• Mirrored-surface delta, measured before regenerating. git diff --numstat fe3fe467 64d9cfa8 over all ten mirrored ACR files gives +2/-1 in context_fabric_common.v1.schema.json and +2/-1 in context_fabric_investigation_result.v1.schema.json. Every other file is unchanged, so this PR carries the one member and nothing else from ACR.
• Pin. SOURCE_COMMIT is ACR 64d9cfa866da0e460ec92fbe4604e8a6d82b4412, the producer change's tip. It is provisional and is re-pinned to the producer's merge commit before this merges.
• node scripts/sync-acr-contracts.mjs generate --allow-write --source <acr worktree parked on 64d9cfa8> rc=0. The script is the only author of every generated artifact.
• node scripts/sync-acr-contracts.mjs check --source <that worktree> → ACR contracts are current.
• node scripts/sync-acr-contracts.mjs check → ACR contracts are current. This is the form CI runs.
• Quality steps, each binary's own exit code:

sync-check rc=0
sync-check-source rc=0
tsc rc=0
eslint rc=0
prettier rc=0
vitest rc=0
corpus rc=0
next-build rc=0

• vitest run:

      Tests  943 passed (943)
   Start at  14:21:32
   Duration  13.35s (transform 28.05s, setup 16.80s, import 48.16s, tests 37.59s, environment 75.59s)

• next build tail:

○  (Static)   prerendered as static content
ƒ  (Dynamic)  server-rendered on demand

Consumer pin. The new describe block follows the pattern of the previous member:

• the new value validates at this pin;
• every earlier member still validates alongside it;
• near-miss spellings are rejected (organization_scope_unsupported_, ORGANIZATION_SCOPE_UNSUPPORTED, organization_scope);
• both enum arrays carry the member, and it validates behaviourally at completeness.refusal_basis;
• an executed repro strips the member from a copy of this pin's own schema and shows that copy rejecting the value, while it still accepts declared_kind_unmatched.

The existing continuation-refusal block's vocabulary-length assertion moves from 5 to 6.

User-facing wording. The service's sentence renders verbatim. A new DeterministicAnswerView test gives a no_match result carrying refusal_basis: organization_scope_unsupported and that sentence. It asserts the sentence, including "organization-wide counts", is visible text under the Limitations heading.

RISK-NOTES

• Nothing keys off the new basis. The workbench renders the service's own sentence through the generic Limitations panel. No display path branches on the value.
• Provisional pin. The mirror is pinned to the producer change's tip, not a merge commit. It is re-derived against the merge commit before this merges; the mirrored delta is expected to be byte-identical.
• Ordering. The producer can serve this value only after its change merges. This mirror accepts it and still accepts every earlier document, so a consumer-first deploy is safe.

[linear-code]

CHAOS-5720