Evaluate scoped validator expressions across filters and roll options

## Parent

- #7

## What to build

Implement the pure typed Validator contract used by filter, count, reroll, explode, and conditional options.

## Frozen contract

- Missing scope means each; `*`, `.`, and `:` mean all, any, and scalar.
- Each scope returns an item mask; aggregate scopes are valid only for conditionals.
- Comparisons are longest-first and type checked; omitted comparison means equality.
- Ranges are inclusive; modulo rejects zero divisors; `min`/`max` require a finite source-backed RollSet.
- `&`, `^`, and `|` share one precedence level and associate left to right. AND/OR short-circuit; XOR evaluates both sides.

## Acceptance criteria

- [ ] RFC-0001 Validator case IDs pass in Rust and installed Python.
- [ ] Equality, ordering, ranges, modulo, source bounds, variables, and wrong-kind errors are covered.
- [ ] Filter, count, reroll, explode, and conditionals reuse one evaluator.
- [ ] Empty validators and invalid scopes return structured spanned errors before random evaluation.
- [ ] Work charging and deterministic short-circuit behavior are explicit.
- [ ] Canonical rendering is identical across Rust, Python, CLI, and docs.

## Blocked by

- #7
- #4
- #12
- #39

Start with the RFC-0001 Validator case IDs and the existing Rust and Python implementations used by filter, count, reroll, explode, and conditionals. Check blocked issues #7, #4, #12, and #39 before starting. Done means the listed acceptance criteria pass consistently across Rust, Python, CLI, and docs.

Written by the indexing model from the issue text.