Harden the syn code-health classifier with differential and worst-case testing

## Context

PR #300 replaces the hand-written Python Rust classifier with the bounded internal syn classifier and resolves the concrete correctness, reachability, durability, and projection-complexity findings discovered during hosted review. The review thread is intentionally closed after merge to avoid unbounded remediation churn.

This follow-up is a non-blocking hardening milestone linked to #275 and PR #300.

## Scope

- Add table-driven or generated module graphs that compare classifier path and cfg reachability with rustc or Cargo behavior for supported syntax.
- Add property/fuzz coverage for nested cfg and cfg_attr metadata, raw identifiers, literal path overrides, root/nested roles, and production-wins reachability.
- Add worst-case benchmarks at or near protocol limits for span merge/projection, module-edge traversal, request decoding, and diagnostics.
- Prove projection remains linear after span sorting and graph traversal remains within the declared edge bound.
- Audit Cargo target-root discovery against cargo metadata fixtures, including autolib/autobins, explicit targets, nested src/bin targets, and workspace-inherited manifest fields.
- Decide whether the classifier should remain one binary source file or be decomposed into cohesive parser, reachability, projection, protocol, and test-fixture modules without exposing a public SDK API.

## Acceptance criteria

- Differential fixtures cover every supported module-resolution role and cfg state documented by ADR 0126.
- Property or fuzz tests have deterministic seeds and bounded CI execution; heavier campaigns run in the weekly slow lane.
- Benchmarks record elapsed time and peak memory for representative and worst-case inputs, with explicit regression thresholds or reviewed baselines.
- Any semantic change updates ADR 0126, code-health governance, exact migration evidence, and the baseline through a new OpenSpec change.
- Fast CI remains focused; expensive evidence is routed to weekly/manual validation.

## Out of scope

- Reopening PR #300 for speculative improvements.
- Publishing the classifier as an SDK crate.
- Relaxing conservative production ownership or fail-closed behavior.

Start with PR #300 and ADR 0126 to identify the supported module-resolution roles, cfg states, and classifier boundaries. Review the Cargo metadata fixtures and define bounded differential, property/fuzz, and worst-case benchmark coverage for the listed cases. Done means deterministic fast tests, weekly slow-lane evidence, regression thresholds or reviewed baselines, and any semantic changes recorded through a new OpenSpec change.

Written by the indexing model from the issue text.