De-fork spike S1: baseline metrics + upstream-merge replay harness

まず docs/internal/2026-07-18-defork-spike-spec.md と既存の marker-guard ジョブを読んでください。次に script/upstream/taxonomy.ts、census.ts、divergence.ts、replay.ts を調べ、必要なベースライン、パース、diff、merge の動作を理解してください。コミット済みのベースライン、空の exemptions ファイル、CI ratchet の配線、最初の v1.18.3 replay、再生成された divergence の数値、feasibility-plan の addendum が存在すれば完了です。

Stage S1 of the de-fork spike (spec: docs/internal/2026-07-18-defork-spike-spec.md, Codex-consensus-approved rev 4).

Deliverables, all in script/upstream/:

• taxonomy.ts — 3-bucket classification (upstream_shared / fork_owned / fork_added_outside_boundary) against the pinned v1.17.9 upstream tree, upstream-existence precedence, 10-path .opencode/ overlap pinned by a generated oracle test.
• census.ts — stack-based marker-block parser, category table, versioned JSON envelope, --summary/--json/--check/--diff-budget modes; multiset ratchet with quantity-scoped committed exemptions.
• divergence.ts — files/hunks/lines vs upstream base per bucket, pinned diff options.
• replay.ts — explicit-base three-way merge via git merge-tree --write-tree --merge-base (no working-tree mutation), conflict taxonomy, census attribution with SHA-mismatch rejection. First real run vs v1.18.3.
• Committed baselines + empty exemptions file + CI ratchet wiring into the existing marker-guard job.
• Regenerated headline divergence numbers + feasibility-plan addendum.

Zero product-behavior risk (tooling/tests/CI only). Mergeability gates per spec §0.