feat(lint): verify reachable vendored imports

[jbeda]

Summary

Lint now plans all explicit inputs as one local import graph and verifies provenance digests for reachable vendored copies. Explicit roots retain full lint behavior; discovered models receive provenance verification only.

Semantics

• Local filesystem traversal only; no network or subprocess path.
• Resolved-path queue and visited set deduplicate shared dependencies and terminate cycles.
• A digest mismatch is emitted once under the affected file path with its direct update remedy.
• Nested unreadable, invalid, unsupported, or out-of-bound edges stop silently; this does not add transitive semantic lint.
• Explicit input paths remain unchanged in text and JSON output.

Verification

• task check
• Graph fixtures cover direct children, owned intermediaries, shared dependencies, cycles, broken nested edges, explicit/discovered deduplication, unsupported vendored children, and path attribution.

Review

This is draft pending the required high review round.