Add read-only preserved artifact diagnostics

[nicho1ab]

Pull Request Evidence

Governing issue and intended outcome

• Governing issue: Make preserved-artifact backfills safely repeatable #475. Issue Make preserved-artifact backfills safely repeatable #475 remains open; this PR adds only the bounded read-only diagnostic needed to identify the remaining 11-facility representation difference.
• Intended outcome: provide deterministic redacted SELECT-only comparison evidence between prepared preserved-artifact values and current persisted source-derived values without adding or invoking a mutation path.

Implementation scope

• Major files or components changed: hosted preserved-artifact difference diagnostic, importer candidate-value comparison support, direct Python CLI and PowerShell wrapper, focused diagnostic regressions, and hosted-backfill documentation.
• Important behavior intentionally left unchanged or out of scope: preserved-artifact write semantics, schemas, migrations, source connectors, live retrieval, facility-reference precedence, reviewer-created state, reviewer UI presentation, deployment configuration, production correction, Issue Fix preserved-artifact backfill failures for 27 facilities #476, and the actual residual 11-facility fix.
• Reviewer UI regression contracts: RT-RC-004 and RT-RC-006 remain protected invariants. Source-derived identities, source-document relationships, reviewer-created-state separation, fixture relationships, and reviewer/audit relationships remain protected; the diagnostic does not query reviewer-created or reviewer-audit state and makes no reviewer-facing presentation or interaction change.

Acceptance-criteria evidence

Acceptance criterion	Evidence and result
Explicit bounded selection	PASS - diagnostic requires one Facility ID or an explicit Facility-ID file and rejects all-existing selection.
Preserved-artifact-only scope	PASS - diagnostic requires operation preserved-artifacts and rejects unsupported operations.
Read-only execution	PASS - focused regression proves SELECT-only comparison and no INSERT, UPDATE, or DELETE statements.
Redacted output	PASS - strings and structured values are represented through bounded metadata and SHA-256 rather than unrestricted source narratives.
Deterministic machine-readable output	PASS - CLI emits compact JSON with schema version, facility count, difference count, and structured differences.
Reviewer/private-state boundary	PASS - diagnostic does not query reviewer-created-state or reviewer-audit tables.
Wrapper parity	PASS - DiagnoseDifferences passes diagnostic mode without dry-run or apply; ordinary dry-run and explicit apply behavior remain unchanged.
Production diagnosis	Pending - after merge and human-operated deployment, the diagnostic must run against exactly the retained 11-facility selector before any residual correction is implemented.

Validation and failure classification

Exact command	Result	Failure classification, if applicable
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' -m pytest tests/unit/test_hosted_ccld_backfill.py::test_preserved_artifact_difference_diagnostic_is_select_only_and_redacted tests/unit/test_hosted_ccld_backfill.py::test_preserved_artifact_difference_diagnostic_fails_closed_on_selection tests/unit/test_hosted_ccld_backfill_cli.py::test_cli_difference_diagnostic_is_explicit_read_only_json tests/unit/test_hosted_ccld_backfill_cli.py::test_cli_difference_diagnostic_rejects_unbounded_selection -q	PASS - 4 passed in 1.92s	none
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' -m pytest tests/unit/test_hosted_ccld_backfill.py tests/unit/test_hosted_seeded_corpus_import.py tests/unit/test_hosted_ccld_backfill_cli.py -q	PASS - 27 passed in 5.69s	none
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' -m ruff check src/ccld_complaints/hosted_app/ccld_backfill.py src/ccld_complaints/hosted_app/seeded_import.py scripts/backfill_hosted_ccld_data.py tests/unit/test_hosted_ccld_backfill.py tests/unit/test_hosted_ccld_backfill_cli.py	FAIL - test import shadowed by loop variable	implementation-caused; SQLAlchemy import was aliased
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' -m mypy src/ccld_complaints/hosted_app/ccld_backfill.py src/ccld_complaints/hosted_app/seeded_import.py scripts/backfill_hosted_ccld_data.py	FAIL - three RowMapping versus Mapping type errors	implementation-caused; explicit casts added
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' -m ruff check src/ccld_complaints/hosted_app/ccld_backfill.py src/ccld_complaints/hosted_app/seeded_import.py scripts/backfill_hosted_ccld_data.py tests/unit/test_hosted_ccld_backfill.py tests/unit/test_hosted_ccld_backfill_cli.py	FAIL - import block unsorted after alias correction	implementation-caused; import organization corrected
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' -m ruff check src/ccld_complaints/hosted_app/ccld_backfill.py src/ccld_complaints/hosted_app/seeded_import.py scripts/backfill_hosted_ccld_data.py tests/unit/test_hosted_ccld_backfill.py tests/unit/test_hosted_ccld_backfill_cli.py	PASS - All checks passed	none
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' -m mypy src/ccld_complaints/hosted_app/ccld_backfill.py src/ccld_complaints/hosted_app/seeded_import.py scripts/backfill_hosted_ccld_data.py	PASS - no issues found in 3 source files	none
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' scripts/check_docs.py	PASS - Documentation check passed	none
PowerShell parser validation of scripts/backfill-hosted-ccld-data.ps1	PASS - exit 0 with no parser errors	none
git diff --check	PASS - exit 0 with no output	none
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' scripts/audit_portable_paths.py publication --field completion_report --input C:\tmp\issue475-correction-3-handoff.txt	PASS - Portable-path contract passed	none
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' -m pytest tests/unit/test_hosted_ccld_backfill_cli.py::test_cli_difference_diagnostic_is_explicit_read_only_json tests/unit/test_hosted_ccld_backfill_cli.py::test_cli_difference_diagnostic_rejects_unbounded_selection tests/unit/test_hosted_ccld_backfill_cli.py::test_powershell_wrapper_exposes_bounded_restartable_interface tests/unit/test_hosted_ccld_backfill.py::test_preserved_artifact_difference_diagnostic_is_select_only_and_redacted -q	PASS - 4 passed in 0.98s after wrapper-contract strengthening	none
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' -m pytest tests/unit/test_hosted_ccld_backfill.py tests/unit/test_hosted_seeded_corpus_import.py tests/unit/test_hosted_ccld_backfill_cli.py -q	PASS - 27 passed in 5.92s after final continuation	none
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' -m ruff check tests/unit/test_hosted_ccld_backfill_cli.py	PASS - All checks passed	none
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' scripts/check_docs.py	PASS - Documentation check passed after wrapper documentation update	none
PowerShell parser validation of scripts/backfill-hosted-ccld-data.ps1	PASS - exit 0 with no parser errors after final continuation	none
git diff --check	PASS - exit 0 with no output after final continuation	none
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' scripts/audit_portable_paths.py publication --field completion_report --input docs/developer/hosted-ccld-backfill.md	PASS - Portable-path contract passed	none
& 'C:\Repos\CCLD-complaints-poc.venv\Scripts\python.exe' -m pytest	Not run - focused diagnostic implementation and required PR CI provide the appropriate repository-wide gate	none

• Implementation-caused failures: Initial targeted Ruff found an import-shadow error, targeted mypy found three missing explicit RowMapping casts, and the next Ruff pass found the corrected import block unsorted. Each was corrected in scope; final Ruff, mypy, focused tests, documentation, parser, whitespace, and portable-path checks pass.
• Pre-existing failures: None relied upon for passage.
• Environmental failures: None.
• Tests intentionally not run and why: Full local suite was intentionally not run because this is a bounded diagnostic implementation; required GitHub CI remains the repository-wide merge gate.

UI and accessibility evidence (when applicable)

Not applicable - no UI or accessibility change.

Reviewer-facing redesign artifact classification (when applicable)

Not applicable - no reviewer-facing removal, merge, rename, relocation, replacement, or redesign.

Documentation, assumptions, and remaining risks

• Documentation impact: hosted-backfill documentation now describes the bounded diagnostic, direct Python syntax, PowerShell wrapper behavior, fail-closed restrictions, redacted output, and operator use boundary.
• Assumptions and limitations: repository fixtures could not reproduce the residual production difference; the retained 11-facility production selector therefore requires the newly added read-only diagnostic after deployment.
• Remaining risks or follow-up: this PR deliberately does not correct the residual representation defect. Issue Make preserved-artifact backfills safely repeatable #475 remains open; no production backfill apply may occur until diagnostic evidence proves the exact remaining entity and fields and a separate correction is reviewed and deployed.

Governed-boundary review

Governed boundary	Status	Specific explanation or evidence
Schemas and migrations	No change	No schema, migration, or canonical persistence shape changed.
Ingestion and source-connector contracts	No change	No connector, source retrieval, source contract, or live-source behavior changed; seeded-import changes expose the existing importer candidate-value comparison boundary for diagnostics.
Security and privacy	Authorized change	Diagnostic output is deliberately redacted and bounded; unrestricted source narratives, credentials, reviewer state, and reviewer audit data are excluded.
Production data and correction behavior	Authorized change	Hosted backfill code gains a SELECT-only diagnostic path using the same candidate-value comparison as the importer; existing write-capable backfill behavior is not broadened or invoked.
Deployment and infrastructure	No change	No Docker, Compose, QNAP, Cloudflare, port, host, or deployment configuration changed.
Repository governance	No change	No repository governance mechanism, policy, workflow, or required-check definition changed.
Required GitHub workflows and checks	No change	validate, docs-check, fixtures, and security remain required and unchanged.
Tests or checks weakened to obtain passage	Authorized change	Diagnostic and wrapper regressions were added or strengthened. No test, assertion, required workflow, or check was removed, skipped, relaxed, or weakened to obtain passage.

Required GitHub checks

• validate
• docs-check
• fixtures
• security