fix(1259-01): lint-rule real runner — keep rule id distinct from lint target

The default lint-rule runner passed check.target as BOTH the --rule id and the
eslint path, so it could never pass (eslint tried to lint a file named after the
rule). Add a distinct check.rule field (rule id) vs check.target (path to lint),
extract a pure exported buildLintArgs() so the mapping is mutation-testable
without spawning eslint, fail-closed on a lint-rule missing its rule id, and carry
the rule into enforcement evidence. Updates verify-phase descriptor docs.

tests/prohibition-probe.verify-tier.test.cjs

@@ -104,7 +104,7 @@ describe('prohibition-probe verify-tier: test-tier ENFORCEMENT (REQ-PROHIB-07 /
     const enforce = require(ENFORCEMENT_LIB);
     const result = enforce.runProhibitionEnforcement(
       testTierProhibition,
-      { kind: 'lint-rule', target: 'no-source-grep', failFirst: true },
+      { kind: 'lint-rule', rule: 'local/no-source-grep', target: 'tests/', failFirst: true },
       { runCheck: () => ({ failFirst: true, passed: true }) },
     );
     assert.equal(result.status, 'green', 'a passing wired lint-rule check must dispose green');