Design-system coupling: scope AIO coverage to the contexts a UI step targets #60

Problem

product design-system couple (and couple_ds in product-core/src/pf/manifest.rs) checks every AIO referenced by any UI step against every context of use the What declares. That is stricter than the model it checks:

• A product with a phone app and a car-display app (Android Auto) declares form_factor: car-display. The car screens use four AIOs (map-browse, display-value, display-collection, trigger-action). The check demands reify rules on the car display for all sixteen AIOs the phone screens use — card entry, camera scan, time picker, … — none of which any car-display step surfaces or offers. Ten "non-conforming" findings that describe nothing real.
• A context declared for a platform whose code hasn't been read yet (platform: iOS) fails for every AIO, which is correct, but is indistinguishable in the output from the previous case.

Proposal

Scope coupling to the contexts a step actually targets:

1. Let a UI step (or an application root / system) declare target_contexts (the §3.2.2 target_platforms / target_classes fields already exist on the schema — use those, or a contexts list), defaulting to all declared contexts when absent.
2. couple checks each AIO only against the contexts of the steps that use it: for step in steps: for ctx in step.contexts: for aio in step.aios: require reify(aio, ctx).
3. Report findings grouped by context, and mark contexts with zero rules separately ("no design system covers context X") from partial coverage.

Acceptance

• A car-display step using only aio-map-browse on a manifest with a car rule for it couples cleanly, while a phone step using aio-edit without a phone rule still fails.
• A context with no rules at all is reported once, not once per AIO.