fix(validate)!: one stable envelope, records separated from schema health

[pablontiv]

Related issue

Closes #68 — the validate surface of it. Defects 6 and 8–15 live in fix, new,
schema apply and query, which this branch does not touch.

What was wrong

#	Defect	Evidence before
1	.stem health and directory verdicts folded into results and summary.total	3-document corpus reported total: 5, paths ["sub/.stem","sub/.stem","a.md","b.md","c.md"], while query --count said 3
1b	Those pseudo-records survived --where	--where "estado == 'Pending'" still returned both sub/.stem entries
2	Empty corpus reported green	total: 1, valid: 1 — the stem-files-exist entry — exit 0
3	yaml-valid and stem-files-exist unreachable	scan failed first, Phase-1 diagnostics discarded, no JSON at all and exit 1
—	Envelope shape varied by invocation	bare rootline/validate for one file, -batch for several, zero bytes for --staged with an empty index
5	nested-root-marker authored info, shipped warn	failed --strict with no way to suppress a supported configuration
4	monotonic-violations mislabelled	4 of 5 categories rendered (type change: ...); min_children/max_children both rendered as field structural

The envelope

Every invocation — one file, several files, --all, --staged on an empty index, and the
scan-failure path — emits rootline/validate-batch version 2:

{
  "version": 2,
  "kind": "rootline/validate-batch",
  "results":        [ /* documents */ ],
  "structural":     [ /* directories, trailing-slash paths */ ],
  "stem_health":    [ { "path": "sub/.stem", "check": "scope-match", "field": "",
                        "severity": "warn", "message": "..." } ],
  "drift_warnings": [ ],
  "notices":        [ { "severity": "warn", "code": "no_records", "message": "..." } ],
  "summary": { "total": 3, "valid": 3, "invalid": 0,
               "errors_count": 0, "warnings_count": 0, "drift_warnings_count": 0,
               "structural_errors_count": 0, "structural_warnings_count": 0,
               "stem_health_errors_count": 0, "stem_health_warnings_count": 2,
               "stem_health_info_count": 0 }
}

Three properties are the contract:

1. All six keys always present, empty collections as []. Nothing appears or vanishes
   with a flag.
2. Disjoint populations, each counted on its own axis. summary.total is a record
   count and agrees with query --count, tree --field root.total and stats --field total.
3. Splitting changed where a verdict is reported, never whether it counts. Exit is
   non-zero on an invalid record, a structural error, a stem-health error, or an error
   notice; --strict adds warnings on all four axes; info never fails.

notices[] is the extension point: run-level diagnostics keyed by a stable code
(scan_failed, schema_resolution_failed, stem_health_unavailable, no_records).

What #63 still has to do — and does NOT have to reshape

#63 (--output never validated; unknown-field warning never fires) can land entirely on
top of this shape:

• --output validation is a rejected invocation, not a corpus finding. Validate the
  flag value before any work and return a plain CLI error (no envelope, exit non-zero) —
  the same convention --outbound-type requires --has-outbound already follows. No
  envelope change.
• Unknown-field warning (a --where naming a field no record carries) is run-level, so
  it becomes one more notices[] entry — suggested code: "unknown_field", severity
  warn, message carrying the fuzzy "did you mean?" hint from
  internal/query.CheckFieldNames. Add a code, not a key. Under --strict it fails,
  consistent with every other warn-level notice.
• rules.ValidationEnvelopeInput is a struct precisely so a further collection can join
  without touching any call site.

The only thing #63 must not do is reintroduce a key that is conditionally absent.

Verification

• just test (go test ./... -race) — all packages pass
• just check (gofmt + golangci-lint + build) — 0 issues
• just coverage-check — TOTAL 89.5%, every package above the 85% floor
  (cmd/rootline 86.2%, internal/rules 90.4%)

Strict TDD: every defect got a failing test first. New files
internal/rules/envelope_test.go, internal/rules/stemhealth_monotonic_message_test.go,
cmd/rootline/validate_envelope_test.go. Existing tests that encoded the old behaviour
(TestValidateStagedNoFiles asserting empty output, TestValidateAll_StemHealthChecks
asserting health inside results) were rewritten to assert the fixed contract.

Reproduced each defect against a built binary before and after — including the two health
checks that previously emitted no JSON.

Breaking change

Title carries ! deliberately: the release workflow reads the squashed PR title, and an
unmarked breaking change would ship as a patch. Upgrade table is in docs/validate.md;
CHANGELOG.md, CLAUDE.md and .claude/skills/rootline/ref-validate.md are updated.

Note for the maintainer

The structural[] split was not in the issue text. It surfaced while verifying the claim
that summary.total now equals the record count: with structural: rules declared,
directory pseudo-records ("/", "sub/") inflated total the same way .stem entries
did. Left in results[] it would have falsified the contract this PR documents, so it is
fixed here rather than deferred. It carries its own regression test asserting a structural
violation still exits 1.