Prevent dead source links for local-only commits

[forhappy]

Summary

• require an exported graph source commit to be reachable from a local origin remote-tracking ref before embedding a forge permalink
• omit source-navigation metadata for local-only objects instead of constructing a GitHub, GitLab, or Bitbucket URL that cannot resolve
• document the offline reachability requirement and cover reachable and local-only commits at the CLI boundary

Root cause

The exporter verified only that sourceCommit existed in the local object database. The bbolt graph was built at local synthetic commit 0e3e6bf, which is not reachable from origin/main, so Compass emitted a GitHub URL for an object GitHub never received.

Reproduction

Replayed export against /Volumes/Workspace/Github/bbolt/compass-out/graph.json. Before the fix, the HTML embedded revision 0e3e6bf and GitHub returned 404. After the fix, the export omits that dead source-navigation record.

Verification

• cargo fmt --all -- --check
• cargo test -p compass-cli --test viewer_export_cli --locked
• cargo test -p compass-cli --test compass_product --locked
• cargo clippy --workspace --lib --bins --locked -- -D warnings
• cargo test --workspace --lib --bins --locked
• sh scripts/check_product_boundary.sh
• direct bbolt export replay

All Cargo checks used CARGO_TARGET_DIR=/Volumes/Workspace/crabbuild-target/compass-main.