fix: refuse unsafe graph snapshot rebuild stubs

[wbugitlab1]

Summary

• Refuse unforced mem::graph-snapshot-rebuild before graph-scope kv.list when the snapshot is missing, empty, or carries a resetAt boundary.
• Keep populated non-reset snapshots rebuildable under the existing safe ceiling.
• Add regressions for empty legacy stubs, post-reset snapshots, populated reset snapshots, populated safe snapshots, and reset enumeration-free behavior.

Closes #330.

Verification

• corepack pnpm exec vitest run test/graph.test.ts --exclude test/integration.test.ts
• corepack pnpm run lint
• corepack pnpm test
• semgrep scan --config p/default --error --metrics=off .
• gitleaks detect --source . --redact --log-opts refs/remotes/origin/main..HEAD
• Codex Security diff scan: no findings