## Summary

- What does this PR do?

## Backlog / Issue

- Which backlog item or issue does it address?

## Core Trust Surface

- Does this PR touch a core write path or authoritative-state contract?
- If yes, which surface?
  - `index --rebuild` / `index --dry-run`
  - `discover --write`
  - `canonicalize --write`
  - config / source / path-resolution behavior
- Which blocking test or acceptance check proves the invariant still holds?

## Validation

- [ ] I ran `make ci`
- [ ] I added or updated tests where needed

## Notes

- Any follow-up work, known limitations, or rollout notes?
