feat(query): accept issue #33 literal examples — diff head + inline kwargs + PA-id auto-route

[hyperpolymath]

Summary

Closes the residual gap on #33: the issue body advertises three example query expressions, but two of the three failed to parse and one parsed-then-matched-nothing under the existing grammar. After this patch, all three expressions in the issue work verbatim.

The S1/S2/S3 architectural work is already in main (see #57, #58, #60, #61, #62, #63). This is the user-facing-syntax polish that lets the issue itself close cleanly against its own documented examples.

What changed

Issue example	Before	After
(crosslang :from FFI :to ProofDrift)	works	works
(category PA001 :severity Critical :pr-state nil)	parse error	parses → (and (rule-id PA001) (severity Critical) (pr-state nil))
(diff :since 2026-04-12 :category PA022)	parse error ("unknown head: diff")	parses → (and (since 2026-04-12) (rule-id PA022))
(category PA001)	parsed, zero matches	auto-routes to (rule-id PA001), matches findings

Three additions to src/query/mod.rs:

1. diff head — keyword-only sugar for (and (kw VALUE) ...) over its :keyword VALUE pairs. Unwraps to the single clause when only one kwarg is supplied so the AST stays minimal.
2. Inline :keyword VALUE kwargs on every unary head — category, rule-id, severity, repo, file, pr-state, since. Implemented via a shared parse_trailing_kwargs helper so adding a new unary head adds a single dispatch row.
3. (category PAxxx) auto-routes to Query::RuleId so the issue's literal example actually selects findings instead of silently matching zero. (category UnsafeCode) continues to match by WeakPointCategory Debug name.

Shared query_for_keyword dispatch keeps the inline-kwargs path and the diff path in lock-step.

Module-header docs updated

src/query/mod.rs now documents the new forms and shows the desugaring:

```text
(category PA001 :severity Critical :pr-state nil)
≡ (and (rule-id PA001) (severity Critical) (pr-state nil))

(diff :since 2026-04-12 :category PA022)
≡ (and (since 2026-04-12) (rule-id PA022))
```

Test plan

• cargo test --lib --no-default-features — 300 passed (288 before; 12 new).
• cargo clippy --all-targets --no-default-features -- -D warnings — clean.
• End-to-end smoke against the binary with the three verbatim issue expressions — all parse, all run, all return "No matches" against an empty hexad store (the expected outcome with no findings registered):
  • (crosslang :from UnsafeFFI :to ProofDrift)
  • (category PA001 :severity Critical :pr-state nil)
  • (diff :since 2026-04-12 :category PA022)

Backwards compatibility

• Pure addition. Every existing query expression continues to parse to the exact same Query AST. Verified by running the full existing test suite (288 tests) unchanged.
• The single-clause diff form unwraps to the underlying clause, so AST consumers never see a needless Query::And wrapper.

Out of scope

• The pre-existing cargo fmt drift in src/assail/analyzer.rs, src/bridge/{classify,lockfile,reachability}.rs, and src/main.rs discovered while running checks. Filing separately to keep the diff scoped.

Refs #33.

🤖 Generated with Claude Code

[hyperpolymath]

FYI: panic-attack Base ruleset now requires chapel-ci-gate (single context, replaces the 6 individual chapel-ci jobs). This PR's workflow predates the gate, so it can't satisfy the new required check. Once #90 lands, run gh pr update-branch 88 (or push a refresh) to pick up the gate workflow. Auto-merge will then proceed normally.