mod: Ext 5 — policy rule-set lint (unreachable/catch-all/dups), 190/190

Static analysis of a policy without running the engine: mod/unreachable-rules
flags rules after an unconditional rule (dead under first-match precedence),
mod/has-catchall? checks total coverage, mod/duplicate-rule-names + mod/rules-ok?
give a well-formedness verdict policy authors can assert. Own suite. +14 tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/mod/conformance.conf

@@ -19,6 +19,7 @@ PRELOADS=(
   lib/mod/api.sx
   lib/mod/fed.sx
   lib/mod/link.sx
+  lib/mod/lint.sx
 )
 
 SUITES=(
@@ -28,4 +29,5 @@ SUITES=(
   "fed:lib/mod/tests/fed.sx:(mod-fed-tests-run!)"
   "extensions:lib/mod/tests/extensions.sx:(mod-extensions-tests-run!)"
   "link:lib/mod/tests/link.sx:(mod-link-tests-run!)"
+  "lint:lib/mod/tests/lint.sx:(mod-lint-tests-run!)"
 )