Hard-cut Ruby to a qualified universal candidate

[forhappy]

Summary

• hard-cut Ruby extraction to the version-1 compass.ruby.candidate universal evidence profile
• emit bounded, deterministic Ruby evidence for namespaces, reopened types, method spaces, mixins, imports, calls, constructors, diagnostics, UTF-8 anchors, and malformed/ambiguous input
• add exact lexical Ruby resolution with hierarchy/reopen handling and convert Rails detection to the universal rails-ruby framework pack
• remove the replaced generic Ruby publisher/resolver path from production
• harden incremental admission with complete cached fact-state checks, copy-on-write snapshot staging, bounded worker stacks, and regression coverage

Qualification

The pinned Ruby audit across Rails, Discourse, and RuboCop reports:

• 89,981 accepted relationships
• observed precision 1.0 (Wilson lower bound 0.9999573)
• source-oracle recall 0.9855669
• zero critical violations and zero ambiguity
• family recall: calls 0.9847768, construction 0.9780676, ownership 0.9912, traits 0.9876594
• per-corpus recall: Rails 0.9794758, Discourse 0.9867323, RuboCop 0.9950513

Five-warm performance samples and exact restore hashes are recorded for all three corpora in docs/implementation/ruby-universal-qualification.md and tests/qualification/ruby-universal-baseline.json. The implementation intentionally remains UniversalCandidate; promotion to UniversalComplete is a separate audit decision.

Validation

• cargo fmt --all -- --check
• targeted Clippy for languages, resolve, and core with -D warnings
• full library tests for compass-languages (53), compass-resolve (59), compass-core (77), and compass-files (6)
• Ruby conformance (11) and Ruby resolution (10) suites
• Rails framework tests
• Ruby source-oracle and quality-audit tests (9)
• product-boundary check
• code-graph-v1 fixture qualification previously passed in bounded/offline parser mode

A final fixture-gate retry was stopped by the mounted target volume reaching ENOSPC while the parser build attempted to download/unpack its full source bundle; no source or fixture failure was reported. Generated local paths (.codegraph/, 3rd/, and apps/web/.vercel/) are intentionally excluded from this PR.