feat(selector): one selector API for writ and lore; directory names follow os-release's lineage - #992

Summary

Lane 19 of #949, alone, straight after #959 (ruled 2026-09-30: "we'll do lane 18 followed by lane 22. two prs and at the end we'll be done with selectors. we'll have common selectors for writ and lore.").

• One package, pkg/selector: it detects the host and answers which of a list of directory names apply to it, and in what order. writ and lore both use it. The rules are stated once, in docs/guides/selectors.md.
• The grammar: [<project>][.<os>][.<arch>][.<extra>...]. Order is significant, a name carries one OS word, and the vocabulary is closed. common.Debian is the form, and common.Linux.Debian is refused.
• The chain follows os-release's lineage: Unix, Linux, ID_LIKE reversed, then ID. On Ubuntu, Linux, Debian and Ubuntu apply. macOS is Unix, Darwin; the BSDs are Unix, then the OS; Windows is Windows.
• Grammar errors refuse the run before anything changes, all listed at once: out of order, two words for one part, a word no part holds. Another machine's well-formed name is excluded silently.
• One total order; the last applied wins: projects as the command line reads (implicit, recorded and not named, named left to right); within a project, the OS word's depth, then the architecture, then the extras; layers base, team, personal. Naming an implicit project (writ deploy common included) or naming a project twice is a command-line error; the bare form is writ deploy (ruled 2026-09-30).
• Collisions say why: each carries both directories' ranks and the part that decided: a later layer, a later project, a more specific OS word, the architecture, or a named segment.
• writ's extra segments: declared in writ.segments with their values and validated. They're set by --segment NAME=value or WRIT_SEGMENT_<NAME> on deploy, upgrade, reconcile and adopt. This resolves writ upgrade and reconcile do not see the segments deploy was given: -s is deploy-only, and reconcile's Config.Segments is never read #970, the segments upgrade and reconcile didn't see.
• lore: a package's platform directories are selected the same way, with Common first; every applicable phase script runs, general to specific. lore deploy plans every package before any deploys, so a grammar error in any package refuses the run. Native packages resolve by the platform's default purl type, pacman included, and lore search labels hits by the same mapping (rpm and alpm hits were labeled apt).
• pkg/platform: it detects through the selector, and falls back along ID_LIKE for package managers (Pop!_OS takes Ubuntu's apt). Its token and lore's detectPlatform are gone.
• writ segment matching ignores its own suffix grammar: order unvalidated, dimensions unchecked, ties undefined #369 (the suffix grammar's enforcement) is resolved here. Its plan is set abandoned, because this one supersedes it.

Also: #959's plan takes its last box and is complete; plans that described the token or the retired Linux.Debian form carry dated notes; the 2.5 architecture status records two places where the document and the code disagree.

• Plan — docs/plans/feature/944-one-selector-api-writ-and-lore.md. It stays active: its last boxes are DANOBLE-UD24-1's convergence and the follow-up issues.

Resolves #944
Resolves #369
Resolves #970

Test plan

• pkg/selector: the chains per distribution, the spelling table, the vocabulary, every grammar error, the ranking, and the segment declarations' refusals
• writ: the most specific link wins, Darwin beats Unix, projects apply in command-line order, grammar errors refuse the build, a collision says what decided it; the implicit and duplicate refusals; adopt's --platform
• lore: platform directories follow the host's chain with Common first; a leftover Linux.Debian refuses the package, and a grammar error in any package refuses lore deploy before anything deploys; phase scripts run general to specific; purl types map to sources
• A review of the whole diff, each finding checked by an independent skeptic: nine confirmed and fixed, four refuted
• make test; make test-scenario, whose lineage step asserts that each ID_LIKE ancestor's consumer deploys on this host
• gofmt; make vet-all and make lint-all on linux, darwin and windows, 0 issues; star lint go; star lint shell; the guides' frontmatter
• After the merge: DANOBLE-UD24-1 converges on the official pre-release; Home/common.Debian's four files deploy on this Ubuntu host, and no other link changes

Time

Computed by the algorithm of noblefactor-ops#188 at merge.