Fix raw source path linting without provenance false positives

[nvk]

Summary

Fixes the raw-source provenance gap reported by @emercons in #88 while avoiding false positives for established raw-source formats.

• validates only source: values that are clearly local paths
• supports absolute paths, file:// URIs, ./ / ../ / ~/ paths, and unambiguous root-relative paths
• accepts both files and directories as valid upstream sources
• preserves session, MANUAL, other URI schemes, schemeless web URLs, and free-form provenance labels
• keeps imported raw-body Markdown links out of local link-integrity checks because those links may be relative to the upstream source
• catches filesystem permission errors without crashing lint

Tests

• generated raw-source-unresolved defect fixture from the current golden wiki
• structural assertion for the new fixture
• negative lint test for an unresolved explicit raw-source path
• compatibility coverage for session, non-file URIs, paths containing spaces, file:// directories, and upstream-relative raw-body links
• all structural test scripts pass
• Codex and OpenCode mirror sync tests pass
• Codex clean-home runtime test passes

Behavioral prompt evals were not run because this is deterministic local CLI logic and no ANTHROPIC_API_KEY is available.

Supersedes #88 with a compatibility-safe implementation. Thanks to @emercons for identifying and clearly reproducing the original gap.