roadmap-aggregate: pmat roadmap aggregate is the one writer of roadmap.yaml; roadmap_fragments.py aggregate becomes the read-only oracle #3493

pmat 3.41.1 (the fleet pin as of #3491 / infra#692) carries pmat roadmap aggregate — the port of scripts/lib/roadmap_fragments.py aggregate (paiml/paiml-mcp-agent-toolkit#1364, contract roadmap-fragments-v1 with 14 selftest rows). Measured in a fresh clone at 3409b29 on 2026-09-18, 919 base + 32 fragments:

• CORRECTED 2026-09-18 (the first version of this paragraph compared the python file against itself: pmat roadmap aggregate with no flag prints and does not write). Re-measured on 920 base + 33 fragments, each writer from a clean checkout of the base: python aggregate --write 643,348 B sha256 8403d71d857df724…; pmat roadmap aggregate (stdout) 643,348 B same sha; pmat roadmap aggregate --write 643,348 B same sha; cmp identical.
• Both --checks read the pmat-written file as ok … == aggregate(33 fragment(s)), idempotent; both FAIL when a fragment is edited and the aggregate is stale.

Two aggregators that agree byte for byte today can drift tomorrow, and a roadmap.yaml with two writers is the second-writer defect the roadmap-parity guard in infra exists to refuse (infra machines/clean-room/roadmap-parity-guard.sh: "a shell aggregator would be a second writer; pmat#1370 is the only one").

Acceptance criteria

• Makefile roadmap-aggregate runs pmat roadmap aggregate and nothing else writes roadmap.yaml; roadmap-aggregate-check runs pmat roadmap aggregate --check AND python3 scripts/lib/roadmap_fragments.py aggregate --check — two independent checkers on the committed bytes, so the byte-identity above is asserted on every run rather than claimed once. Either disagreeing is RED.
• scripts/lib/roadmap_fragments.py stays: adopt, changed, split(), the 12-row --selftest with its registered mutation, and the census check_roadmap_fragment_required.sh imports are all load-bearing and are cited by contracts/apr-roadmap-fragments-v1.yaml's falsification tests. Its aggregate --write path is no longer what the Makefile calls.
• contracts/apr-roadmap-fragments-v1.yaml scope/references name pmat roadmap aggregate as the writer (pinned through tools.toml) and the python module as the reference implementation and oracle. No obligation is weakened or removed.
• The proof in the PR body: sha256 and byte count of roadmap.yaml from both aggregators on the PR's own tree, and both --checks green.

Refs #3296 (fragments), #3490/#3491 (the pin), pmat#1364.