Feature/Fix: Contain ambiguous lineage families

[iam-brain]

Summary

• scope lineage identities and exceptional parent discovery to one normalized Codex home
• preserve incomplete, truncated, and malformed evidence instead of silently dropping it
• route every family exclusively through primary accounting or conservative containment
• retain deterministic descendant usage when ancestry is missing and expose privacy-safe diagnostics

This is another isolated component of the planned Codex scanner rearchitecture. It keeps the production legacy total authoritative while making shadow accounting safer around malformed and ambiguous rollout histories.

Closes #22

Validation

• swift test --filter 'CodexLineage(Shadow|Ledger|Discovery)Tests' (28 passed)\n- make check\n- env SDKROOT=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX26.5.sdk make test (642 selections, 54 groups, no failures or retries)