fix: reject structurally invalid phrase directions

[virtue039]

Two agreeing model votes could bind a direction that does not fit the selected property's declared ends. For a Person → Project property, the observed “林岚不再负责甲项目” replies selected reverse / end, producing a Project → Person typed row. Candidate admission checked whether either orientation fit, but did not validate the orientation the model actually chose.

Validate each vote's selected direction against the existing class hierarchy and entity/literal shape before committing a binding. Invalid directions become undecided with both raw votes and an invalid_direction reason retained; they create no typed row or implication question. The answer is not silently flipped or converted to semantic none.

Existing invalid agent bindings are redecided even when their fingerprint is current, including caches awaiting only a marks question. If the model fails or returns unreadable output, the invalid cached decision becomes undecided and its unsupported projection is retired. Human decisions, including decisions made while a request is in flight, retain their existing precedence. This uses the existing alignment snapshot contract; it adds no schema, public API, migration, or prompt change and is independent of #1203.

Validation:

• Before the production fix, three new regression scenarios fail against the old implementation: agreeing invalid votes, unchanged invalid cache, and unreadable cache repair. After the fix, all 30 phrase-alignment lifecycle tests pass with PostgreSQL required.
• Locked workspace tests: 1502 passed, 0 failed, 6 existing ignored. Formatting, workspace/all-target Clippy with warnings denied, server build, frozen web install, and web build pass.
• Normal CI regressions cover forward-only/reverse-only relations, literal attributes, valid decisions after a definition edit, unchanged legacy caches, failed repairs, and human protection. A unit matrix also covers inheritance, unknown types, and unconstrained ends.
• Two disposable copies of the original acceptance databases were run through the real server/worker with the original recorded model votes. Each unchanged reverse agent binding became undecided, its incorrect live typed row was retired, the stored case remained failed with status=undecided, and the human control was unchanged. This is recorded-vote replay, with zero new real-model calls; the original databases and original acceptance failures are preserved.

Old bindings are repaired on their next normal alignment run. This enforces structural validity; when both orientations fit, semantic direction still depends on model or human judgment. The recorded case does not become a correct forward answer, and negative-case support remains outside this PR.

[WaylandYang]

Thank you for tracking this down to the exact gap: a candidate admitted in either orientation, then bound in the one that does not fit.

The check is in the right place, and sending an invalid direction to undecided with both votes kept is the conservative outcome; nothing is flipped on the model's behalf. I ran the alignment tests on a fresh database: 30 pass on the branch, and the three new regressions fail against dev's production code, as described. The person-decided case passes on both, which is what it should do.

Merging. Thanks again for the careful work.