Refuse a record header that disagrees with itself

[iderex]

The record format fixes a header of a few fields, and the refusals planned so far
read one of them. The state is checked against the three the lifecycle names, and
the question and answer sections are checked for content. Nothing checks that the
header agrees with the tree it sits in or with itself, and two pieces of this plan
already rest on fields nothing validates.

The listing sorts oldest unanswered first, which is an ordering over the date the
question was written. A date nothing parses sorts wherever the comparison happens
to put it, and the order is the one thing a reader takes from that listing.

The slug is how a reader gets from a record back to its directory, and the
promotion section makes that walk matter to somebody on another board. A slug that
disagrees with the directory it sits in breaks the walk silently, because both
halves exist and only their agreement is missing.

Three refusals, each either present or absent in the text.

The slug in the header is the name of the directory the record sits in. A mismatch
is refused and the message names both strings, because which of the two is wrong
decides the repair.

Every date in the header is a date, written the one way the record format names. A
field carrying a month, a season or a sentence is refused. This is the field the
listing sorts on and the field a reader uses to tell a question asked last week
from one asked two years ago.

An answer date is not earlier than the question date, and there is no answer date
while the state is asking. The second half is the one worth spending the fixture
on. A record carrying an answer date while claiming to still be asking has been
edited towards a state it is not in, and it passes every other check planned here.

What this does not do is judge whether the dates are true. Nothing in a checkout
says when somebody started thinking about a question, so a date is a claim its
author made. The check holds the shape and the ordering, and it says so where it
is defined, because a green run is otherwise read as evidence that the timeline is
real.

Done when the runner refuses all three cases, each has a fixture in the suite that
trips exactly that refusal and no other, the message names the record and the
field, and the run passes on the current tree.

[iderex]

All three refusals here read the header, and there is no header yet.

The record format is #15, and the decision record it owes is not in the tree:

git ls-tree --name-only origin/main docs/decisions/
docs/decisions/0000-how-decisions-are-recorded.md
docs/decisions/0001-the-runner-is-written-in-go.md
docs/decisions/0002-repository-layout.md
docs/decisions/0003-the-experiment-lifecycle.md
docs/decisions/0004-what-happens-to-the-code.md
docs/decisions/0005-how-a-result-leaves.md
docs/decisions/0006-everything-here-is-public.md
docs/decisions/0007-headless-by-birth.md
docs/decisions/0009-the-checks-do-not-run-experiment-code.md
docs/decisions/0010-a-flaw-in-shipped-software.md
docs/decisions/0011-the-exit-codes.md
docs/decisions/0012-the-supported-platforms.md

A header that disagrees with itself is a comparison between fields, and which
fields exist, what each is called and what values each may take is what #15
fixes. Writing the refusal first would mean inventing that answer inside a
check, and #15 would then have to be written around the check rather than the
check around #15.

What the runner does hold today is the layer underneath. record-is-not-text
and record-begins-with-a-byte-order-mark are on the default branch, so by the
time a header check exists it can rely on the bytes being the text the author
wrote, which is the failure that would otherwise make a field comparison
unreadable.

[iderex]

Two of the three refusals are on PR #109. The third cannot be written as this
issue states it, and the reason is a collision with a rule already on the
default branch rather than something missing from the tree.

The first refusal here asks that the slug in the header is the name of the
directory the record sits in, and that a mismatch is refused. Enforcing that
makes two-experiments-share-a-slug unreachable. Two experiments can only
answer to one slug when at least one of their records declares a slug that is
not its own directory name, because two directories under experiments/ cannot
share a name. So every tree that trips the sharing rule also trips the mismatch
rule, and the sharing rule loses the fixture the suite requires of it:

go test ./internal/check -count=1
--- FAIL: TestCases/two-experiments-answering-to-one-slug
    check_test.go:51: refusal produced that no case expected: record-slug-disagrees-with-its-directory

That was measured with the mismatch refusal written and the rest of this branch
in place, then reverted. The case-folding route does not rescue it either:
refuseSlug refuses any slug carrying upper case, so a pair differing only in
case is already refused for its shape, which the comment at refuseSlugs
already says.

The three repairs available, none of them this issue's:

Retire two-experiments-share-a-slug, on the reasoning that the mismatch rule
subsumes it. That deletes a landed guard and its fixture, which is a change to
what #59 argued.

Keep both and give the sharing rule precedence, so a record whose slug names
another experiment's directory is refused once rather than twice. That is a
rule about which of two refusals wins, written into an operator, and it is
designed backwards from a fixture.

Fold the two into one property covering both directions of a slug that does not
name its own directory. That is one property replacing two, which again reaches
into what #59 landed.

The two date refusals do not depend on any of it and are on #109. This issue
stays open on the slug half, and what it waits for is a decision about which of
the three repairs the slug rules take.