feat(ontology): declare the closed vocabularies and the missing interfaces

The capability catalogue covered five surfaces and missed most of the
interfaces: gui, tui, MCP server, HTTP server and daemon were all absent, so
an agent asking how to talk to simon was told about a third of the answers.
Nothing noticed because the catalogue was only ever checked against itself.
`every_interface_module_is_declared` now checks it against the tree.

The larger gap was that nothing declared the *value sets*. An agent receiving
`{"status":"no_baseline"}` had no way to know whether that was one of three
possible values or thirty, nor which mean act-now. `ontology::vocabulary`
declares the closed sets simon emits — provenance, apply status, verdict,
scan status, severity, confidence, support — with what each value means for a
caller deciding what to do.

`tests/vocabulary_conformance.rs` constructs every real variant, serialises
it, and asserts the emitted set equals the declared set in both directions.
It serialises rather than listing variant names, because a `rename_all`
change would leave the Rust names identical and every declared string wrong.

That test earned itself immediately: the first draft declared a provenance
value `reported`, which does not exist — the real variant is `specification`.
I wrote it from memory instead of reading the enum, and the check caught it
on first run.

Verified both failure directions: undeclaring `findings` fails with "an agent
switching on this field would meet a value its schema does not contain", and
declaring a `quarantined` that no variant produces fails with "a schema that
lists cases which cannot occur teaches an agent to handle fiction".

802 lib tests, 60 across the conformance suites, fmt and clippy clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>