fix(rules): honor descendant scope matches

[pablontiv]

What

• make stem-health scope-match recognize matching files in descendant directories governed by an ancestor .stem
• preserve ownership boundaries for descendant scope.match overrides and nested root: true stems
• update validation documentation, managed skill guidance, and ADR 0009

Related issue

Closes #214

Why

validate --all recursively discovered and validated descendant CONTRACT.md records, while stem health inspected only files beside the declaring .stem. Under --strict, that mismatch produced exit 1 for an otherwise valid corpus.

How

StemState.EffectiveScopeMatches derives the closest non-empty scope.match owner from each inventoried file's existing governance Chain. EvaluateStemState consumes that state-local presence map, keeping prospective overlay evaluation pure and avoiding a second filesystem/resolution authority.

Regression coverage includes inherited descendant matches, child overrides, nested roots, direct matches, true orphan scopes, and the exact two-descendant validate --all --strict acceptance case.

Verification

• just check
• just test
• just coverage-check — 89.9% total; every package floor passed
• just validate — 126/126 roadmap records valid
• exact CLI acceptance — 2 valid descendant records, 0 scope warnings, exit 0
• independent final review of 85e84a5..21a4fd5 — READY, no Critical/Important findings

Checklist

• Tests pass (go test ./... -race)
• Code is clean (go vet ./...)
• Changes are documented if user-facing
• Linked to its issue with a closing keyword, or deliberately left unlinked (intermediate PR of a chain)