feat: provider-cache bypass knob; reject non-final comparator chain steps

- check() gains cacheProviderResults (per-check option + policy default): the
  provider cache is a STORE-RETRIEVAL cache (wall-clock), independent of the
  caller's decision { now }; callers who pin time or want fresh retrieval can
  opt out per-check or globally.
- The generator now rejects a comparator evidence referenced at a NON-final
  chain position (a comparator compares values at (src, candidate) but
  provides no candidate set, so it cannot enumerate intermediate nodes).
  Final-position comparators still lower to condition steps.

Tests: cache bypass (per-check + policy), comparator final OK / intermediate
error.

src/generator/RuleGenerator.js

@@ -1111,6 +1111,15 @@ export class RuleGenerator {
             out.push(...this._expandChainSteps(resolved.steps, refStack));
             continue;
           }
+          if (resolved.type === 'relational_comparator' && idx !== steps.length - 1) {
+            // A comparator compares values at (src, candidate) but provides no
+            // candidate set — it cannot enumerate intermediate nodes, so only
+            // a FINAL comparator step (verified at the known object) lowers.
+            this.errors.push(`Chain step '${stepName}' references a comparator evidence at a non-final position. ` +
+              'Comparators can only be the final chain step (the object is known); intermediate positions are not enumerable.');
+            out.push(step);
+            continue;
+          }
           // Condition step: inline the evidence's config as a rule step. As the
           // FINAL step the engine verifies it at (intermediate, object); as an
           // INTERMEDIATE step the engine EXPANDS it from the current node