Two phaseRank functions with opposite unknown-phase fail-safes are unlinked; plus helper clones #160

Severity: Low, with one fail-safe trap. Review finding D11; deferred by #157. Re-verified at 1c4e71e.

The trap: there are two phaseRank functions whose defaults for an unknown phase are deliberately opposite, and nothing links them:

• internal/core/aggregate/coverage.go:363 maps unknown to 0: "an unrecognized phase is NEVER evaluated/enforced".
• internal/catalogue/catalogue.go:233 maps unknown to 3: "ranks highest so it never caps a valid phase".

A future "unify the duplicate helper" refactor would silently invert one of the two fail-safes.

Plain clones (same body, no semantic trap):

• isYAML: internal/catalogue/load.go:132 ≡ cmd/assent/lint.go:106
• readBounded: internal/provider/transport.go:107 ≡ internal/forge/gitlab/gitlab.go:285
• tmplPlaceholderRe re-declared in internal/lint/scope.go:67-72 (its comment says the original file "is off-limits to this story")
• hand-rolled contains (aggregate/coverage.go:743) where slices.Contains is already used elsewhere

Fix: now, add a cross-link comment on both phaseRanks stating why their defaults differ, ideally with a test that pins both behaviours. Share only the type-safe clones (isYAML, readBounded, slices.Contains) on next touch.