feat(driver): share finding selection across CLI and agent surfaces

[e54-bot]

Summary

Implements #430: finding/diagnostic selection is implemented once in
wright-driver (FindingSelection + SelectionOutcome, select.rs) and
shared by every finding surface.

• Shared selection (severity threshold, rule id, file = resolved
  span.path, max): applied to envelope diagnostics (check, analyze,
  lint) and lint findings; wright-agent/v1 findings, lint, and
  costEstimate requests accept the same fields as flat request
  properties.
• Verdicts are truthful: selection runs after exit/ok are computed
  on the complete set, and SelectionOutcome carries total, withheld,
  and the full set's max severity, so PASS/WARN/ERROR and the exit code can
  never be understated by a filtered view.
• Explicit truncation: selection: {"total": N, "withheld": M} appears
  next to the filtered array in JSON; text mode prints
  ... N finding(s)/diagnostic(s) withheld (--max).
• Text grouping: consecutive lint findings sharing rule id and message
  collapse into one entry that lists all locations (the 9×repeated-value
  cake fixture now renders as one entry with 9 --> locations).
• Unknown --rule-id/rule is a usage error (CLI exit 2, agent
  invalid-selection), never a silent empty result.
• Compatibility: omitting every selection option reproduces the
  previous output byte-for-byte — findings stays a bare array, and no
  selection member appears.

Schemas (wright-agent-v1, wright-check-v1), the agent contract doc, and
the CLI docs/help are updated. cost CLI flags join with the query surface
in #429, which this PR does not implement.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets --all-features — all green
• New tests: driver unit tests for each dimension + unknown-rule error;
  CLI e2e (filtering, --max withheld counts in text+JSON, grouping of the
  cake fixture, byte-identical envelope without options, unknown id exit 2,
  and the ablation guard: check --rule-id filtering an error diagnostic
  keeps exit 1); CLI↔agent same-set equivalence test; stdio transport
  selection test
• Verified against tests/fixtures/workshop/real-world/overpy-cake.ws
  end to end (CLI text/JSON and serve stdio)

Closes #430