Validate catalog graphs and acquisition mappings

[omry]

Add the invariants that exist only across a whole catalog, above record-local
validation and above the per-manifest release graph walker.

Every outgoing reference must resolve exactly: the catalog holds a record at
that exact identity, its schema is one the reference permits, and it stays
inside the referring record's tool and release namespace. A tool record indexes
releases and is exempt from the release-namespace rule, which is the only
exception the design allows.

Reachability is proven from every tool record, and an unreachable record fails
rather than being ignored. An orphan is not harmless: it is catalog data no
request can ever select, so it can drift out of agreement with the records that
are reachable without anything failing.

Acquisition mappings are checked catalog-wide. Every artifact record must have
exactly one source mapping, one content digest cannot be mapped from two
manifests, and records sharing a content digest must agree on size across the
whole catalog rather than only within the one manifest PTD-06 can see.

No aggregate ceiling is introduced. The parked source bounded selected
contributions at 4096; the design defines no such ceiling, so this slice
declares none and bounds recursion by reference-edge depth instead.

---

• -> Validate catalog graphs and acquisition mappings #98
• Load bounded hierarchical portable tool catalogs #96
• Validate release graphs and external evidence #95
• Validate target composition and fixture coverage #94
• Define no aggregate ceiling on portable tool definitions #93
• Validate immutable portable tool records #91
• Add bounded strict portable record decoding #90
• Define portable tool record data model #89
• Expose portable Python requirement validation #88
• Define portable tool implementation plan #86
• Support local-source exclusions and implicit-root Python sdists #82
• Define portable tool composition model #81

[omry]

Closing as a duplicate of #97.

The PTD-08 slice was rebuilt on an amended PTD-07 after PR #96 round 1 required the catalog record index to be keyed by exact (id, digest) rather than by ID alone. The rebuild produced a new commit rather than an amend, so Sapling created this pull request instead of updating #97. #97 is the pull request already in stack #87 with the correct base, and it now carries the rebuilt commit d0eb610, so this one is redundant.

No review was requested here and no approval evidence exists, so nothing is lost.