feat(spec): backfill Export terminology + diagnostics/legality/pipeline (ADR-0009/0010)

Lift the business decisions the MVP made into the Lean master, per constitution
rule 5. lake build green (20 jobs), no sorry.

- Artifact.lean: `inductive Artifact | singleFile | fileTree` — product shape is
  part of a target's value (ADR-0009); it determines the assemble/reduce step.
- Render.lean reworked target-centric (ADR-0009, amends ADR-0005's matrix):
  `TargetSpec` carries `artifact` + a per-kind `renders` map (field visibility
  lives in this map); `RenderConfig.spec : TargetId → Option TargetSpec`; `covers`
  rewritten (target must exist AND its map covers the kind) — semantics continuous
  with ADR-0005 so renderIgnored still typechecks. `BuildStepForm` (declarative |
  shell) is a structural anchor for the build form (shell hatch = ADR-0005's
  medium-only category b) without replicating the schema.
- Diagnostic.lean extended: `DiagKind` (7 classes) + `DiagKind.severity` (six
  error, renderIgnored warning); `Oracle` makes external-facility verdicts
  (compiles/refsResolve/dataConforms/contentFilesPresent) an explicit
  implementation boundary; `Legal` = no error-level diagnostic (backfills
  ADR-0005's deferred full-legality), with renderIgnored deliberately excluded
  (it's a warning).
- Pipeline.lean: the 5 phases (load→structural→schema→compile→coverage) as
  structure — order + the compile gate (compile runs only on zero prior errors) +
  load halts the pipeline. Algorithms stay out of Lean (depth ceiling).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

spec/Spec/Courseware.lean

@@ -1,24 +1,31 @@
 import Spec.Courseware.Primitives
 import Spec.Courseware.RichContent
+import Spec.Courseware.Artifact
 import Spec.Courseware.Element
 import Spec.Courseware.Lesson
 import Spec.Courseware.Render
 import Spec.Courseware.Diagnostic
+import Spec.Courseware.Pipeline
 import Spec.Courseware.QuestionBank
 import Spec.Courseware.Course
 
 /-!
 # Courseware —— 产品层契约(课程工程文件)
 
-护城河:课程"工程文件"的语义母本与合法性规则。决策出处 ADR-0005 / 0006 / 0007。
+护城河:课程"工程文件"的语义母本与合法性规则。决策出处 ADR-0005 / 0006 / 0007 / 0008
+/ 0009 / 0010。
 
 已填实(PINNED):
 - `Primitives` —— 基元载体(表示留给实现;schema 形态见 ADR-0006)。
 - `RichContent` —— 富内容 = 带虚拟路径的 typst 源(ADR-0006 的 prose 母本)。
+- `Artifact` —— export 产物形状(单文件 / 文件树),target 值的一部分(ADR-0009)。
 - `Element` —— kind 标签 + 依赖 schema 的数据。
 - `Lesson` —— element 的有序序列(序载教学语义、不建模时长)。
-- `Render` —— (kind × target) 渲染配置矩阵 + covers。
-- `Diagnostic` —— Severity + checker 第一条诊断(缺渲染 ⇒ warning)。
+- `Render` —— export target = 一次 build(map + reduce):target-中心的 `TargetSpec`
+  携产物形状 + per-kind map;`covers` 判定;build 形态结构锚点(ADR-0009,修订 ADR-0005)。
+- `Diagnostic` —— Severity + 7 类诊断的含义与级别 + **合法 lesson = 无 error 级诊断**;
+  模型外设施诊断以抽象谓词 + `Oracle` 实现边界表示(ADR-0010)。
+- `Pipeline` —— 检查管线的 5 阶段、执行序、compile 门控(ADR-0010)。
 
 留白骨架(核心关系 OPEN,已 surface 不臆造):
 - `QuestionBank` —— 题库与 element 的关系(引用 vs 内联)。