[SLICE B] Post-compaction validator: detect + re-inject missing pinned constraints (#1657)

[Lexus2016]

Parent: #1657 — Governance Decay security fix

Depends on

Slice A (pin mechanism + parser) must merge first — this slice consumes the pinned-constraint set it produces.

Context

After compaction, soft deployment-specific rules (merge cap, verification-separation, tool scoping) are silently dropped 30-59% of the time (arXiv:2606.22528). This slice adds the post-compaction safety net: detect when a pinned constraint is missing and re-inject it.

Scope (this slice only)

1. After each compaction event, compare the post-compaction context against the pinned-constraint set (from Slice A)
2. If any pinned constraint is missing from the post-compaction result, re-inject it
3. Log a warning when re-injection fires (for observability — signals compaction is erasing safety rules)
4. Integration test: create a context with pinned constraints, run compaction that drops them, verify they are re-injected

Out of scope

• Changing compaction strategy (head_tail vs recency-truncate) — advisory only, noted in parent
• Selecting which constraints to pin — deployment-specific config, not framework

Success criteria

• Post-compaction validator checks pinned set against compacted context
• Missing pinned constraints are re-injected
• Warning logged on each re-injection event
• Integration test covers the erasure → re-injection path
• Fits 200-line cap for autonomous merge