fix: a recorded note's definition carries insertion markup, and the stateless reject reads it

[JSv4]

Closes #636

The problem

#634's adversarial review empirically confirmed the mirror of the bug it was fixing. The
stateless reject pruned every note definition its resolution orphaned, unconditionally. That
unconditional prune existed as cover for #614's deliberate choice to leave a session-recorded
note's definition unmarked — and the omission made the redline ambiguous to a stateless consumer:

• a w:ins citation next to an unmarked definition is what a session-authored note insertion
  produced (insertFootnote/insertEndnote under render_inline recording write an irreversible mark instead of refusing #614), where reject must remove the definition;
• but it is also exactly what a comparison produces when the counterpart merely cites a husk
  the baseline already owned — where reject must keep it, because rejecting reproduces the
  baseline.

The unguarded prune picked the first case and ate the second: rejecting that redline deleted a
content-bearing definition the baseline was entitled to keep, Reject(Compare(l, r)) ≠ l —
verified by two independent review agents before this fix (baseline 1 note, rejected 0).

The fix

The same move #631 made on the accept side: put the missing fact into the redline, then read it.

The definition's content now records. InsertFootnote/InsertEndnote under
tracked-change recording mark every definition run w:ins and insertion-mark the paragraph
marks, through MarkParagraphContentAndMark — the session's existing single owner of "this whole
paragraph is one revision" (the MoveBlock machinery), so no new mechanism. This matches what
Word writes for an inserted footnote (its text renders as an insertion in the note pane) and what
the diff engine's own redline has always carried for a wholly-inserted note — verified against
the WC035 insert-direction redline, whose definition arrives fully w:ins-marked. #614's
unmarked-definition rationale ("no independently meaningful resolution") described a granularity
Word itself permits; the real cost of the omission was the producer ambiguity above.

The reject prune takes the same blockless guard as accept. PruneNotesEmptiedByAccept
becomes PruneNotesEmptiedByResolution: a definition the resolution both orphaned and emptied
goes (a wholly-inserted note on reject, a wholly-deleted note on accept); an unmarked husk keeps
its content and stays. Reject(Compare(l, r)) ≡ l and Accept(Compare(l, r)) ≡ r now both hold
for the note stores, with one shared, direction-neutral rule. The session's own editorial resolve
paths (DS418) deliberately keep the unguarded rule, as before.

Compatibility

A redline saved from a #614-era session (its definition unmarked — a shape shippable for four
days) now rejects to an orphaned husk through the stateless path instead of losing the note;
re-authoring the redline with the current version restores full reversibility. Recorded in the
CHANGELOG entry.

Tests

• DS434_StatelessReject_PreservesABaselinesOwnHuskThatTheCounterpartCites (new) — the
  review's reproduced mirror case, red before this fix (rejected count 0 instead of 1).
• DS369_RecordedNoteDefinition_IsInsertionMarked_AndStatelessResolutionsReadIt (new, both
  note kinds) — pins the marking shape (every run inside w:ins, paragraph marks
  insertion-marked), that the stateless reject takes the note with zero diff against the baseline
  (the insertFootnote/insertEndnote under render_inline recording write an irreversible mark instead of refusing #614 contract, now achieved by reading the markup rather than by the unguarded prune), and
  that the stateless accept keeps the note with the markup resolved away.
• The insertFootnote/insertEndnote under render_inline recording write an irreversible mark instead of refusing #614 family (DS366–368, including the reversibility-proof residue check) and the Accepting a redline does not reproduce the counterpart's note store, and neither choice is right for every document #631
  family (DS429–433) pass unchanged.
• Full suite: 4,226 passed, 0 failed. Corpus differential against a main baseline: zero movement
  attributable to this change (no corpus fixture carries a live w:ins note citation, and the
  reject path is not corpus-exercised); the only content mismatch is Accepting a redline does not reproduce the counterpart's note store, and neither choice is right for every document #631's already-merged RP050
  row.

Part 2 of #636: recorded, deliberately unhandled

The "cited childless shell" robustness nit (a definition emptied while its citation survives)
requires synthetic input Word's UI cannot author — deleting all of a note's text tracked leaves
the final paragraph mark unmarked, so the real Word flow accepts to an empty-paragraph note,
which we handle correctly. The degenerate shape and the deferred fix (leave a minimal empty
paragraph, pending Word-side evidence) are now recorded in the corner-cases doc's RP050 entry,
which is the right institutional memory for it — so this PR closes the issue rather than leaving
a tracker item whose next step cannot be taken in this environment.

After the second adversarial round (third and fourth commits)

The review's verification pass empirically confirmed three behavioral findings, all addressed:

• The guard reads the legacy engine's dialect (DS435, red before the fix): WmlComparer
  re-synthesizes an unmarked w:footnoteRef marker run into every inserted definition it
  renders, so a purely-blockless guard shipped an orphaned marker-husk on reject where the
  pre-Reject has the mirror of #631's husk bug (blocked by #614's unmarked definitions), and accept can ship a cited childless note #636 unguarded prune removed the note. The predicate is now scaffolding-aware
  (IsEmptiedToScaffolding): note-reference-mark runs count as emptiness, real content never
  does.
• One user action, one revision identity: the citation envelope and every definition
  paragraph share a single author/date pair; previously each paragraph took its own monotonic
  date, splintering one insert into separately-dated revision groups. DS369 asserts one
  distinct w:date across body and note.
• A still-cited note a resolution strips bare stays bare (DS436). The reviewer's suggested
  repair — restore a minimal empty paragraph — was implemented and then reverted by evidence:
  the corpus genuinely contains cited childless notes (WC064-Footnote ships one;
  WC063-Footnote-Mod's note is childless), and the repair broke both WC round-trip suites,
  because Accept(Compare(l, r)) ≡ r means reproducing exactly that shape. The engine will not
  manufacture content the counterpart does not have; the decision and its evidence are recorded
  in the corner-cases entry.
• Plus: DS434 pins the session-leg distinctness (the editorial reject still strips the husk —
  deliberately, now said on purpose) and shares one husk fixture builder with DS430; the
  same-release CHANGELOG's insertFootnote/insertEndnote under render_inline recording write an irreversible mark instead of refusing #614 entry and both architecture docs are reconciled with the new
  contract; and the rule's owner now documents the session interlock (the session resolver keeps
  a note's last block alive, so naively unifying it onto the guarded prune would silently stop
  pruning session-rejected recorded notes).

Final state: full suite 4,228 passed / 0 failed; corpus differential vs main shows zero
library-attributable movement (the only differing rows are the #633 harness's new observation
channels).