governance(build): add groups zip family

[ChBrain]

Closes the missing zip family for the groupings layer. Unblocks PR #564 once it lands on main and syncs to culture/release.

Why now

scripts/build_zips.py produced two zip families (cultures-* and engine-*). The groupings layer (groups/<id>/, introduced via #563 + #566) had no shipping path. The moment a culture file linked to a grouping (e.g. the DACH baking on Germany / Austria / Switzerland position files), the link flattener rewrote ../../groups/dach/dach_position.md to bare dach_position.md and the cultures - Zip build test failed because no zip carried that file.

New family

groups-<id>.zip   one per directory under groups/; carries that
                  grouping's .md files plus LICENSE, flattened into
                  the same cultures/ namespace as engine files.

Deployer contract becomes three layers:

cultures-<region>-<country>.zip    +
engine-raw.zip                     +
groups-<id>.zip   (for each grouping the culture references)

All extracted into the same folder; every link the culture's files emit resolves.

Implementation

Function	Purpose
discover_groupings()	Walks groups/<id>/, returns sorted dirs containing at least one .md. Empty dirs are skipped; missing groups/ returns [] (no error — supports branches that predate the layer).
_grouping_items()	Collects each grouping's .md files, ships them via _ship() (metadata strip + link flatten) into cultures/<basename>.
build_groups_zips()	Emits one groups-<id>.zip per discovered grouping. Wired into build_all() after build_engine_zips().

Grouping basenames like dach_position.md don't collide with country files (culture_<adj>_*.md) or engine basenames, so the flat cultures/ namespace stays collision-free.

Test updates

Test	Change
test_culture_zips_resolve_mixed_with_engine	Extracts every groups-*.zip alongside each culture zip + engine-raw.zip. Filters broken-link reports to only fire on outbound links from the culture's own files. Inbound back-links from a grouping to a non-co-extracted member culture (e.g. dach_position.md → culture_austrian_position.md when extracting cultures-africa-nigeria) are not a defect of Nigeria's deployment unit — they resolve when the multi-member region/world zip is the culture vehicle.
test_groups_zips_self_consistent (new)	Each groups-*.zip extracts cleanly on its own with no broken intra-zip links. Skips when groups/ is absent (current state on main).
test_discover_groupings_skips_empty (new)	Fixture-based; verifies empty grouping dirs don't produce zips.
test_build_groups_zips_produces_one_per_grouping (new)	Fixture-based; one zip per non-empty grouping, files shipped into cultures/.
test_build_groups_zips_absent_directory_returns_empty (new)	Fixture-based; no groups/ → returns [], no error.

The fixture tests use a synthetic tree so behavior is validated deterministically even on this branch where no real groups/ exists yet.

Verification

Run	Result
Clean main (no groups/)	17 pass, 1 skip ✅
Simulated culture/release + #564 overlay (groups/dach/ + DACH-linked position files)	18 pass ✅
python tests/branch_scope.py advise --files scripts/build_zips.py tests/test_build_zips.py	governance/<name> (base main) ✅

Sequencing

1. This PR → main
2. Open sync/release-from-main-zip-family → culture/release
3. culture(europe): bake DACH group membership into member positions #564 picks up the new build_zips.py and the Zip build job passes (it already has ## Title chapters and v2 schema in place via the DACH migrations)

Ref: #564, #563, #566

---

Generated by Claude Code