[0.3.0-C] Plan minimal safe revalidation from semantic operation impact

[mberrys]

Problem
#129 correctly requires re-preflight after every fix, but rerunning every check over every page is unnecessary and will not scale. The system needs a conservative impact model: rerun only what can be proven affected, and fall back to full validation whenever impact is uncertain.
Technical direction

enum class PDFEvidenceDomain
{
    Geometry,
    Images,
    Color,
    Fonts,
    Transparency,
    Overprint,
    Metadata,
    Structure,
    Security
};

struct PDFOperationImpact
{
    QSet<PDFEvidenceDomain> domains;
    QSet<int> pages;
    bool affectsDocumentScope = false;
    bool requiresFullRewrite = false;
    bool impactComplete = false;
};

PDFRevalidationPlan planRevalidation(const PDFOperationImpact& impact,
                                     const PDFResolvedProfile& profile);

Acceptance criteria

• Every registered operation declares impact domains and target scope.
• Unknown/incomplete impact produces full revalidation.
• Evidence-cache invalidation and check selection use the same impact model.
• The planned subset produces the same final verdict as a full run on the golden corpus.
• Before/after reports identify reused and recomputed evidence.
• A standards conversion always invokes the independent oracle even if its local impact set appears narrow.
  Dependencies: [0.3.0-C] Automatically re-preflight after every fix #129, [0.2.0 trust-contract] DocumentContext as the single revision authority for caches and async results #236, [0.2.0] Build a shared Evidence Graph so checks reuse one page traversal #240, [0.2.0 independent-validation] Institutionalize independent standards and renderer validation #241.