Slice 7: every refusal through check/, the pending codes included #204

Parent

#195

What to build

Every remaining rule moves into check/, one function per code, in both implementations. That includes the codes resolution still stops at: E_UNAUTHORISED_SECRET_REFERENCE, E_UNBOUND_SECRET_GRANT, and the refusals for a dependency or exposure placeholder that names no edge, coordinate, exposure or field. The two missing refusal fixtures land (SC-02, SC-04, SC-24 to SC-27, SC-29).

Acceptance criteria

• No resolver throws for an authored mistake; each is a coded diagnostic with a fixture in both implementations.
• lint:codes shows the pending list emptied of these codes.

Blocked by

• Slice 6: render the composed estate and the edge #203