feat: chain-step evidence composition — expand evidence steps in chains

A chain step that references a derived evidence is now expanded at compile
time, keeping the engine a flat edge-traversal evaluator:

- DIRECT evidence step -> renamed to its underlying relation
  (member_of(user,*g){ group_read(g,doc) } where group_read = can_view
  becomes step 'can_view').
- CHAIN evidence step -> its steps are spliced into the parent chain
  (a sub-path flattens into the linear source->...->object traversal).
- Any other evidence type (defeasible/logical/comparator) as a step is a
  compile-time error: it is a condition, not an edge traversal.
- Cycles and self-references through chain steps are compile-time errors
  (the existing composition cycle guard now covers steps).

Rigor: oracle campaign gains a chain_step_composition construct; illegal
mutations gain a non-lowerable-chain-step case. Fixture suites updated to
retarget the self-recursive 'canRead/canAccess/...' terminals (an unsupported
recursion pattern that now fails loudly) to an any-typed 'reachable' fact,
preserving the nested-pattern parsing intent.

tests/rigor/dsl-generative-oracle.test.js

@@ -32,6 +32,7 @@ const FACTS = `
   fact can_access(group: Group, doc: Doc)
   fact owner(group: Group, doc: Doc)
   fact granted(user: Employee, doc: Doc)
+  fact group_perm(group: Group, doc: Doc)
   fact banned(user: Employee)
   fact mfa(user: Employee)
 `;
@@ -116,6 +117,17 @@ function buildProgram(kind, ps) {
       oracle = pOwn;
       break;
     }
+    case 'chain_step_composition': {
+      // group_read (a direct evidence) used as a CHAIN STEP inside can_via:
+      // the step is expanded at compile time to the underlying can_view edge.
+      const [pm, pv] = ps;
+      evidence = `evidence group_read(group: Group, doc: Doc) { group_perm(group, doc) }
+                  evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { group_read(g, doc) } }`;
+      edges.push({ src: 'u:1', relation: 'member_of', dst: 'g:1', possibility: pm });
+      edges.push({ src: 'g:1', relation: 'group_perm', dst: 'doc:9', possibility: pv });
+      oracle = Math.min(pm, pv);
+      break;
+    }
     default:
       throw new Error(`unknown construct: ${kind}`);
   }
@@ -151,7 +163,7 @@ function runCheck({ kind, ps }) {
 }
 
 const CONSTRUCTS = ['direct', 'chain', 'tuple_to_userset', 'fusion_min', 'fusion_max',
-  'when_unless', 'never_always', 'requires_when', 'composition'];
+  'when_unless', 'never_always', 'requires_when', 'composition', 'chain_step_composition'];
 
 describe('DSL generative oracle parity (rigor)', () => {
   it('generated legal DSL compiles and every check matches the oracle', async () => {