feat(driver): share finding selection across CLI and agent surfaces

[e54-bot]

Summary

Implements #430: finding/diagnostic selection is implemented once in
wright-driver (FindingSelection + SelectionOutcome, select.rs) and
shared by every finding surface.

• Shared selection (severity threshold, rule id, file = resolved
  span.path, max): applied to envelope diagnostics (check, analyze,
  lint) and lint findings; wright-agent/v1 findings, lint, and
  costEstimate requests accept the same fields as flat request
  properties.
• Verdicts are truthful: selection runs after exit/ok are computed
  on the complete set, and SelectionOutcome carries total, withheld,
  and the full set's max severity, so PASS/WARN/ERROR and the exit code can
  never be understated by a filtered view.
• Explicit truncation: selection: {"total": N, "withheld": M} appears
  next to the filtered array in JSON; text mode prints
  ... N finding(s)/diagnostic(s) withheld (--max).
• Text grouping: consecutive lint findings sharing rule id and message
  collapse into one entry that lists all locations (the 9×repeated-value
  cake fixture now renders as one entry with 9 --> locations).
• Unknown --rule-id/rule is a usage error (CLI exit 2, agent
  invalid-selection), never a silent empty result.
• Compatibility: omitting every selection option reproduces the
  previous output byte-for-byte — findings stays a bare array, and no
  selection member appears.

Schemas (wright-agent-v1, wright-check-v1), the agent contract doc, and
the CLI docs/help are updated. cost CLI flags join with the query surface
in #429, which this PR does not implement.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets --all-features — all green
• New tests: driver unit tests for each dimension + unknown-rule error;
  CLI e2e (filtering, --max withheld counts in text+JSON, grouping of the
  cake fixture, byte-identical envelope without options, unknown id exit 2,
  and the ablation guard: check --rule-id filtering an error diagnostic
  keeps exit 1); CLI↔agent same-set equivalence test; stdio transport
  selection test
• Verified against tests/fixtures/workshop/real-world/overpy-cake.ws
  end to end (CLI text/JSON and serve stdio)

Closes #430

[Teakowa]

Verified against the #430 acceptance criteria: shared driver-side selection, truthful verdict/exit ordering, withheld reporting, text collapsing, unknown-rule usage errors, additive wire shapes, and CLI↔agent parity coverage all check out. Two findings inline. The branch also conflicts with main after #436 (compact_lint_rules + the agent-contract wording); resolution is straightforward — keep the compact rules payload and add selection on top.

[e54-bot]

Follow-up verification complete on 5bad6ad:

• Both review findings are addressed — --file now selects by canonical file identity across as-passed, root-relative, cwd-relative, and absolute spellings on all surfaces (check/analyze/lint/agent findings/lint/costEstimate); the Envelope::selection rustdoc now reflects actual emission semantics.
• Independent local re-review verified: verdict/exit computed on the full set before selection, no-selection output is byte-identical to the pre-change baseline (db42356), the feat(driver): serve compact rule metadata in the lint result #436 merge preserves compact rules metadata alongside selection, --max/collapse/unknown-rule behavior all conform to Filter and group findings in the shared driver layer #430.
• CI run 36585859815: all checks green.

[Teakowa]

LGTM