fix: seven CLI defects a real end-to-end run exposed

[david-hudec-networg]

This is the fixes PR. Seven defects the CLI shipped, all of them hit by
running a five-source discovery engagement through it end to end rather than
found by reading. Its companion #47 is
the improvements PR and proposes language changes; nothing here does.

That split is deliberate. These are bugs, and they should not wait on a design
debate about the other one.

Read it in seven commits

	commit	what it is
1	three add scaffolds emit shapes their own schema rejects	independent of everything else
2	generated templates carried no property information at all	the root cause of the add family
3	sequence sections were scaffolded as ID-keyed maps	the writer's own defect, visible once 2 lands
4	test: every add scaffold must validate	goes green here and nowhere earlier
5	nextid could not be trusted as a source of truth	three compounding defects
6	derivedFrom on value streams and capabilities	the one document type with no machine-checked provenance
7	ubml walk	bookkeeping for a stakeholder review

Each builds on the last. Nothing is written and then rewritten.

ubml add produced a document ubml validate rejects

ubml init proj --minimal && cd proj
ubml add glossary terms
ubml validate .
  :14:11  error  Type mismatch: expected object, got object (/terms/TM01000)
  :18:3   error  Type mismatch: expected array, got object (/categories)

Swept across every type add can create: 13 of 13 failed.

One line in generate-template-data.ts:

properties: [],          // <- every section, every type

TemplateSection never carried properties, so TEMPLATE_DATA held none for
anything and the scaffolder wrote a bare key. TM01000: with an empty body
parses as null. The types that appeared to work only did so because items.ts
happened to carry a hand-written example, and two of those were wrong in other
ways.

Extraction now resolves the item schema from the document schema —
patternProperties for an ID-keyed map, items for a sequence, inline or behind
a $ref. Five shape bugs fell out of the sweep:

	was	now
add hypotheses	root/children as {id, text, …} and arrays	HY#####-keyed maps
add process	wrote id: PR01000 inside the item	dropped; the ID is the key
sequence sections	scaffolded as ID-keyed maps	empty list, shape in comments
reference placeholders	always AC#####	prefix from the referenced definition's own pattern
roiAnalyses	RO#####	ROI##### — the prefix regex was [A-Z]{2}

ubml nextid could not be trusted

Three defects compounding, none of which announced itself.

It consumed the ID it reported. Asking what the next ID would be wrote that
answer back, so three calls gave three answers, each higher.

syncids could not repair a stale cache. It kept only the larger of cached
and supplied, so a scan finding a lower truth was discarded. It printed
AC: 1020 → 11 and wrote nothing — the one case the command exists for.

minStart was applied to a continuation. A workspace numbered from AC00001
was told its next actor was AC01000, leaving a 989-wide hole.

The visible symptom was Highest: AC00008 and Next ID: AC01020 printed one
line apart, both meant.

Two additions

derivedFrom on valueStreams and capabilities — the one element family
whose provenance the validator could not see.

ubml walk — which insight is next, in the order the material was produced,
with the source text beside the claim; and recording the answer. It stops at
bookkeeping: reading a reply, judging an ambiguous answer, noticing a correction
changed the meaning are not a CLI's job. set rewrites one line rather than
reserialising, because a workspace is a document a human is reading.

Tests

291 passed, 3 skipped. typecheck and lint clean.

cli-add-validates.test.ts fails 13 of 13 against the previous behaviour — I
rebuilt from pre-fix sources to confirm the test can fail. id-scanner.test.ts
covers all three nextid defects. cli-walk.test.ts covers ordering, evidence
before claim, ID last, one line changed, and a byte-identical round trip.

Note on ordering

#47 is stacked on this one and shows
these commits too until this merges. Merge this first.