feat(foundation): offline synthetic scope/permission inspector (FI-FILBERT-8 APPROVED r6)

Rocko-authored, Filbert-reviewed inspector (r6 manifest
a4a44930...) with full review/build/verdict evidence under
docs/plans/reviews. 43/0 selftests, oracle zero-disagreement,
foundation checker PASS. Owner A9 acceptance recorded separately.

scripts/foundation/fixtures/demo/demo-file-change-src.expected.txt

@@ -0,0 +1,10 @@
+SYNTHETIC PREVIEW — NO LIVE EFFECTS
+preview: no live registrations or permission grants
+authentication: not-modelled; declarations: unverified-simulation
+result: allowed
+reason: allowed
+rule: null
+selection: agent agent-a, project p1, workspace w1, assignment assignment asg-a-w1 @workspace:p1/w1 rev 1
+operation: file.change target workspace:src/main.mjs
+proposal: null
+diagnostic: null