Hold the order-canonical recompute to the kernel's findings (#159)

* Hold the order-canonical recompute to the kernel's findings

Two engines read every response. The kernel's `diff_json` decides WHETHER
two bodies differ: it sees through the encodings a value is carried in, and
it alone applies the run's body allowlist. The order-canonical recompute
exists for a narrower job — deciding WHERE a difference belongs once ordering
is resolved, so a permutation is one difference at its collection rather than
however many positions this run's two orders scattered it across.

Nothing held it to that job. `classify_http_body_diff` replaced the kernel's
rows with the recompute's whenever bodies were present, so the less-informed
engine had the final say and could manufacture a difference the authority
never found. It did: a system that echoes the connector request it built
serializes a headers map whose key order is seeded per process, the kernel
read the embedded document and reported nothing, this engine read the same
string as bytes, and a replay of a recording BY THE IMAGE THAT RECORDED IT
failed 99 of its 100 correlations on identical behaviour.

A recompute row now survives only where some kernel row speaks about the same
region, compared as declarations so that either engine may describe one
difference deeper, shallower, or at another position of the same collection.
Rows standing over a region the kernel judged the same are dropped.

This costs no signal — the recompute recurses the same structure the kernel
does, so every region the kernel can report in already carries a row here —
and it fixes the class rather than the instance: no encoding has to be taught
to two engines for them to agree, and an allowlisted path can no longer block
through an engine that never saw the allowlist.

* Name what the recompute sets aside, and never let it erase a kernel finding

Two things the previous commit left open, both raised in review.

The invariant was stated in one direction. The recompute could not invent a
difference the kernel never found, but it could still erase one: the
reconciled rows replaced the kernel's outright, so a reconciliation that
emptied a non-empty kernel set discarded the kernel's own findings and
nothing blocked. Only a broken artifact produces that shape, since the
recompute recurses the same structure the kernel does, but nothing in the
types guaranteed it and the safety of setting rows aside rested on an
asserted claim. It no longer does. A reconciliation that would leave a
non-empty kernel set with nothing is refused, and the kernel's rows stand.

The rows set aside were dropped by a filter: no kind, no counter, no
warning. This repository has already paid for that shape once, and here it
made the incident itself unobservable. A suite tolerating a hash-ordered
headers map on every one of its responses read identically to one whose
echo was byte-stable, and the thing worth knowing about such a suite, that
the kernel's judgment is load-bearing for it, left no trace.

The slot for saying so already existed. `order_nondeterminism_warnings` was
declared, folded from `OrderNondeterministicWarning`, reported on every
scorecard, and hardcoded to zero: it once counted UPDATE inherited-row
ordering noise, was retired when UPDATE results began comparing only
assigned columns, and has written zero on every scorecard since. It now
counts each path the recompute reported and the kernel judged the same, the
kind is noted without counting a divergence, exactly as `ReplyCanonAbsorbed`
is, and a warning names the path and says why it did not count. The field's
doc says what it meant before and that no non-zero value has ever carried
that meaning.

The verdict is unchanged by both. What changed is that a reader can tell
"the bodies agreed" from "the bodies disagreed and the kernel decided it did
not matter", and that the scorer can no longer turn a broken artifact into a
pass.

* Carry every unspoken-for kernel row through, not only when all of them are

The erase guard was stated in both directions but enforced all-or-nothing:
it fired only when the reconciliation was completely empty, so a kernel row
that nothing backed was still dropped silently whenever one other kernel row
was backed. Reaching that needs the same broken artifact the total-erase
case needs, so this is the same precondition defended exactly rather than a
new failure mode: if it is worth a guard, it is worth guarding row by row.

A kernel row that no surviving recompute row speaks about now stands as the
kernel wrote it. The unspoken-for rows are judged against the recompute's
survivors alone, so two of them in one collection cannot speak for each
other and lose one. The special case goes; the `None` path means only what it
meant before this series, that the run predates stored bodies.

The erase test is restated for the exact form. Its outcome is unchanged: the
kernel's row blocks. What changes is the mechanism, and that the recompute's
own unbacked row is now named as one the kernel judged the same, which is the
accurate reading of that fixture. A second test pins the partial case, with
two positional kernel rows in one collection both carried through.

The handoff document that recorded a run under the counter's retired meaning
now says so, so a reader grepping for the field is not led to the DB case.

Author: iemyashasvi