Link folders under the blueprint by the spelling Git committed, and fix render --ref's help

[Deicyde]

Two follow-ups from the post-merge review of #295, #296, #297, #300 and #301.

Folder links on macOS (bad5b1b, 00e30ee)

#301 made code, Markdown source and source-note links name the spelling macOS Git committed when a name is decomposed (NFD) on disk. Source-note links looked their whole path up in a map of committed file paths, so a link to a folder, such as [the notes](../sources/) or a subfolder, never matched. When a folder above it was decomposed on disk, as Finder writes names, the link named the on-disk spelling and GitHub returned 404. Before #301 that layout got no links into the blueprint at all, with a warning; after it, file links were right and folder links broke.

_sources_base now maps each captured file's leading folder paths as well as the file itself, and a link takes the committed spelling of its longest mapped leading path. A folder with no captured file below it, such as one holding only a .gitkeep (render skips hidden files), gets the committed spelling of the leading folders it shares with a captured file; its own name keeps the link's spelling. A link to a subfolder the commit does not hold, an empty one or one holding only untracked hidden files, 404s under any spelling, as it did before. An untracked note that render captures still drops every link into the blueprint, with a warning.

render --ref help (69a10b6)

Since #300, code links need only the captured Lean sources in the commit, and links into the blueprint need the blueprint too. The help said links appear only if the commit holds "the exact rendered inputs". It now says which links need which inputs.

Tests

test_a_link_to_a_folder_names_the_spelling_git_committed puts the blueprint under a folder whose name is decomposed on disk, with a note in sources/ and a sources/drafts/ folder holding only a committed .gitkeep. The links to ../sources/, the note and ../sources/drafts/, and a statement's Markdown source link, must all name the committed spelling, the on-disk spelling must appear nowhere on the page, and there is no warning. It runs on every OS: like test_decomposed_file_names_link_to_the_spelling_git_committed, it makes git ls-tree print the composed spelling macOS Git prints, through a helper both tests now share. Either half of the fix alone fails it (the file-only map, or an exact-only lookup), under real macOS precomposition and under Linux Git's behavior emulated with core.precomposeUnicode false; with both, it passes. The other source-note and decomposed-name tests pass unchanged. They ran with a plain Python driver, without pytest or Lean, because the machine was over its load limit, so CI is the authority. ruff check is clean.

Overlaps with open PRs

• Scale roadmap inventories and the full DAG explorer #90 gets one new conflict, in _SourceBase.href: keep this branch's longest-prefix loop, then path = "/".join(parts) and Scale roadmap inventories and the full DAG explorer #90's quote(self.ref, safe='') return. Taking Scale roadmap inventories and the full DAG explorer #90's side fails the new test on Linux CI.
• Treat every published page as untrusted #215, and the PRs stacked on it (Add read-back cards and the testimony validator #216, Show statement review on the site #217, Label statement approvals by the repository's code-owner review policy #219, Add statement-review commands #284), build the same NFC map inside their _sources_base(..., spellings). Whichever lands second keeps the leading-path loop, iterating that function's spellings argument under another local name. If the other side is taken, the new test fails on Linux CI.
• No other open PR's conflicts change.

[Deicyde]

Review: changes requested, to comments and the description only. The code is right.

Reviewed by four independent lenses (correctness and tests; necessity and scope; design and style; claims and contracts), a refuting verifier per lens and a completeness critic. I checked each surviving finding against the code and re-ran the tests on main 30e28b1 with this PR merged.

What holds

• The fix is correct and minimal. Both halves are needed: with the file-only map or with an exact-only lookup, the new test fails. When nothing in a path has a recorded spelling (ASCII names, Linux, Windows, macOS with core.precomposeUnicode false), links are byte-identical to before.
• The new --ref help matches what render does.
• The PR still merges cleanly into current main, including the changes Rewrite angle-bracket and query links whole, and link only captured notes #326, Leave malformed link targets as written in render and the runtime #327 and fix(render): preserve mathematical bodies and Markdown validation #362 made to _rewrite_links: source-note links still reach _SourceBase.href with the same tail, and the targeted render and linker tests pass on the merged tree. CI is green on 69a10b6.

Changes requested

1. The comment in _SourceBase.href (autoform_cli/render.py) is wrong twice. Render does capture a folder holding only a .gitkeep: it records every folder and skips the hidden file inside. And the lookup does not cover such a folder fully: only the leading folders it shares with a captured file take their committed spelling, while a decomposed name of its own keeps the link's spelling. Suggested:

   # A folder with no captured file below it, such as one holding only a `.gitkeep`, has no entry of its own,
   # so only the leading folders it shares with a captured file take their committed spelling.

2. The _SourceBase.spellings docstring dropped Link decomposed (NFD) file names by the spelling Git committed #301's reason, and "as links spell them" reads as if links spell paths in NFC, when href normalizes the link side because they don't. Suggested: """Committed captured paths and their leading folders, keyed by NFC form, since a link spells a path as typed."""
3. The description's "No other open PR's conflicts change" is now false. Scale roadmap inventories and the full DAG explorer #90 merges cleanly with main today and gets one conflict from this PR, in _SourceBase.href. To resolve it, keep this branch's longest-prefix loop, then path = "/".join(parts) and Scale roadmap inventories and the full DAG explorer #90's quote(self.ref, safe='') return. Taking Scale roadmap inventories and the full DAG explorer #90's side fails the new test on Linux CI. Treat every published page as untrusted #215 and the PRs stacked on it still get the documented _sources_base hunk.
4. The description's "That also covers a folder render does not capture" repeats both mistakes from item 1. Suggested: "A folder with no captured file below it, such as one holding only a .gitkeep (render skips hidden files), gets the committed spelling of the leading folders it shares with a captured file; its own name keeps the link's spelling."

Optional

• href joins relative and tail into a string only to split it again; parts = [*self.relative.split("/"), *tail] is equivalent.

None of these changes behavior. Once they are in, mark the PR ready; it can then be merged.

[Deicyde]

Follow-up: the requested changes are in.

• 00e30ee replaces the comment in _SourceBase.href and the spellings docstring with the suggested text. Render captures a folder holding only a .gitkeep, though no file inside it, and only the leading folders it shares with a captured file take their committed spelling. The docstring again says the keys are NFC because a link spells a path as typed. No behavior changes.
• The description now says what a folder with no captured file below it gets. It also lists the conflict this PR adds to Scale roadmap inventories and the full DAG explorer #90 in _SourceBase.href, with its resolution, beside the documented _sources_base hunk for Treat every published page as untrusted #215 and the PRs stacked on it. Rechecked on main e4b5506: no other open PR's conflicts change.
• The optional href simplification is left out: it is equivalent, and nothing needs it.

ruff check is clean, and the folder, decomposed-name and source-note tests pass.

CI is green on 00e30ee (Linux 3.10 and 3.13, real Lean, the skeleton suite, the REPL and Windows). With the requested changes in, this is ready: mark it ready for review and merge.