The W3 fail-loud hard-locator validator (digest.sh) treated an entry as
actionable via class=="actionable" OR .locators.claim, but the RENDER
tier also honors a top-level .claim (it renders via
`jq -r '.claim // .locators.claim'`). A hand-crafted entry like
{"class":"reaction","claim":"mergeable=true","locators":{}} fed via
--stdin/--from-file rendered as a CLAIM@seq with an EMPTY locator,
escaping the exit-4 hard-locator fail-loud gate.
store.sh never emits a top-level .claim (non-canonical shape), but a
non-canonical caller could bypass the gate. Align the validator to also
treat a top-level .claim as actionable, matching the render tier's
precedence, so any entry that WILL render as a claim must pass the hard
-locator gate or FAIL LOUD (exit 4, nothing emitted).
Closes#905
Part of #892
