feat: Layer-2 fabric semantics + evidence-grounded AS-path diagrams

[downwithbgp]

Summary

Project-owner semantic correction: MAN LAN is a Layer-2 exchange/fabric —
it has no ASN for the case study, does not speak BGP, does not originate
routes, and does not appear as an AS-path hop. NORDUnet AS2603 is one
attached network and the target of the completed historical pilot. This
session adds compact, evidence-grounded AS-path diagrams (inspired by the
familiar operational visual grammar, never copying another product).

Internal project-owner review; zero external evaluation sessions (pilot
registry unchanged). No canonical evidence changed, no analyses rerun, no
new events.

Changes

• V11 migration: optional reviewed interconnection_context on case
  studies (Layer-2 fabric, reviewed attachments with ASN labels where
  established, provenance, limitations). Reviewed interpretation only;
  production analysis never uses it as protocol evidence.
• New source-neutral component (src/catalog/web/path_diagram.rs,
  server-rendered SVG, no JS, no Graphviz): observed AS-path nodes (bold
  ASN, reviewed short name, plane-matched/origin/changed marking, prepend
  compaction), before/after state comparison (Event baseline / Pre-finding
  / First changed / First return / Final; absence is a state block, never a
  "withdrawn" node), Layer-2 fabric diagram (wide neutral rectangle, grey
  undirected attachment lines, no fabric ASN), reviewed-unobserved
  relationship edges (dashed). Text equivalents always preserve the full
  normalized sequence. All input from canonical lifecycle.json artifacts.
• MAN LAN page: Incident context / Completed public-BGP analysis /
  Scope first-screen hierarchy; fabric diagram + text table + limitations;
  representative observer route story derived from canonical evidence (the
  direct route-views2 finding: baseline AS11537 AS2603 → pre-finding →
  absence → return with AS24489 ×4 prepend → final), with links to the
  full run evidence; diagram legend; "attached networks/connectors"
  heading; pilot wording corrected (never "complete incident verdict").
• Smithville run page: dashed reviewed adjacency Adjacent(AS19782, AS11550) labeled "reviewed relationship sought — not observed in
  selected evidence"; absence block for the observed area; explicit "not
  observed in the selected public baselines" (never "does not exist").
• API: structured interconnection context + path-comparison facts
  (text sequences, observation kind); no layout serialization, no SVG in
  the API.
• Evaluation kit: answer key gains explicit incident-context truths for
  the MAN LAN scenario; regenerated. Tasks unchanged (no answers added).
• Docs: GLOSSARY (Layer-2 fabric context, Attached network, Observed
  AS-path diagram, Reviewed unobserved relationship), DOMAIN, UX (diagram
  grammar), OBSERVABILITY (the ContainsAny[11537] predicate is a reviewed
  transit-presence proxy, never a MAN LAN ASN), case-study README,
  facilitator guide, SCHEMA-VERSIONS/CATALOG-SCHEMA (v11).
• 34 new tests (15 component + 19 page-level): neutrality (generic
  tests use documentation ASNs; integration tests load tracked evidence),
  fabric-no-ASN, non-directional attachment lines, canonical-derivation,
  absence-not-ASN, compaction, lifecycle-state preservation, dashed-vs-
  solid, plan-hash stability, artifact byte-identity.

Verification

cargo test debug + release (1446 passed, 0 failed; baseline 1412),
fmt, clippy -D warnings, rustdoc -D warnings, deny (licenses/bans),
cargo package + extracted-crate build, demo init/verify, answer-key
byte-stable regeneration (packaged crate differs only in the documented
stderr.log summary fields), read-only browse of all 10 evaluator URLs
with the DB hash unchanged, project-scope audit, secret scan,
audit-docs, release/audit guards, clean-clone + extracted-crate page
verification. Full-diff review findings addressed (per-run skip,
SVG escaping, u32 bounds).