Local pair matcher with residual routing to batched validation

## Problem

Every role-compatible candidate pair costs a model call even when structured capability parameters already determine compatibility. The per-pair stage dominates enrichment cost (~$3.00 of ~$3.85 per set on HOB).

## Proposed change

Deterministic local matcher resolves pairs from v2 capability parameters (zone/action/qualifier compatibility); only unresolvable pairs enter the batched validation queue (20 per batch, implemented on branch enrichment-validation-batching); candidate construction records the resolution basis (local vs model) per pair.

## Acceptance Criteria

- [ ] AC1: >= 80% of HOB candidate pairs resolve locally (measured on stored benchmark results)
- [ ] AC2: Benchmark gate unchanged and green: accepted/rejected verdicts for model-validated residue match benchmark.json
- [ ] AC3: Matcher is pure/deterministic; omissions aggregate per mechanism with a distinct reason
- [ ] AC4: Engine sends only residual pairs to validation; full HOB re-run <= 60 validation calls

## Dependencies

Blocked by #526 (needs v2 structured parameters to match on).

## Implementation classification

- **Estimated size:** M
- **Orchestration risk:** High
- **Reason:** New matching logic whose precision directly affects recommendation quality; benchmark-gated.

Start by reviewing the v2 structured parameters from dependency #526 and the enrichment-validation-batching branch, then inspect the candidate construction and benchmark.json results. Implement and evaluate deterministic local resolution plus residual validation against the HOB acceptance criteria: at least 80% local resolution, unchanged verdicts, aggregated omission reasons, and no more than 60 validation calls.

Written by the indexing model from the issue text.