Pin every language corpus

[zmaril]

Summary

• rename the status surface from Policies to Known Deviations
• add fresh, hydratable corpus locks for all nine previously unlocked languages
• add fetch --lock-only so large populations can be pinned with bounded disk use
• validate lock language, archive provenance, file identities, and SHA-256 values in treebank status --check
• document the exact 10-language lock inventory and keep Rust as the sole scheduled full-corpus canary

Verification

• cargo test --workspace --no-fail-fast
• treebank status --check (10 locks, 0 configuration errors)
• JSON/provenance validation across every corpus-locks/*.json
• git diff --check