feat: direct fact checks consult registered providers

Checking a FACT relation directly (rt.check('u:1', 'owns', 'doc:9')) now
runs the provider-retrieval pipeline instead of returning 0 without ever
consulting the registered provider. The retrieval set for a direct fact
check is the fact itself (plus, for evidence checks, the injectable deps as
before). The result reports requiredFacts/providedFacts/missingFacts for the
fact, and missingFacts surfaces 'no_provider' when neither a provider nor an
edge can satisfy the check.

src/runtime/DSLRuntime.js

@@ -559,7 +559,13 @@ export class DSLRuntime {
       this._checkNodeType(user, meta.params[0].type, 'subject');
     }
 
-    const required = this.requiredFacts(relation);
+    // Retrieval set: for an evidence, the injectable facts it depends on; for
+    // a direct FACT check, the fact itself is the retrieval target (its
+    // provider, if registered, supplies the edge — checking `owns` directly
+    // must consult the `owns` provider, not only evidence-mediated checks).
+    const required = new Set(this.requiredFacts(relation));
+    if (meta && meta.kind === 'fact') required.add(relation);
+    const requiredList = [...required];
     const providers = { ...this.factProviders, ...(options.factProviders || {}) };
     const maxRounds = options.maxProviderRounds ?? 3;
     const partialRelations = [];
@@ -577,7 +583,7 @@ export class DSLRuntime {
     // Fixed-point provider retrieval loop.
     for (let round = 1; round <= maxRounds; round++) {
       let newRelationsThisRound = 0;
-      for (const fact of required) {
+      for (const fact of requiredList) {
         if (satisfied.has(fact)) continue;
         const factMeta = this.relations.get(fact);
         const provider = providers[fact];
@@ -653,7 +659,7 @@ export class DSLRuntime {
 
     return {
       ...result,
-      requiredFacts: required,
+      requiredFacts: requiredList,
       providedFacts: injectedRelations.map(r => r.relation),
       missingFacts
     };