fix(contract+lock): extend ogar_codebook mirror with PRODUCT + ACCOUNTING_ACCOUNT (OGAR #111) and bump pin

D2 — follow-up to the merged sibling D1 (lance-graph #595, `81d08c42`)
which mirrored OGAR #110's auth domain. OGAR #111 just merged on the same
day, adding two more entries to `ogar_vocab::class_ids::ALL`:
  - `product 0x0207`  (← `product.template` / `product.product` converge)
  - `accounting_account 0x0208`  (← `account.account` /
                                    `account.account.template` converge)

Without this sync, `lance_graph_ogar::parity::COUNT_FUSE` panics again
the moment a consumer (q2's Railway docker build is the canary) bumps
its own OGAR pin to current main: mirror=43, ALL=45.

Two coordinated fixes:

1. lance-graph-contract: extend ogar_codebook::CODEBOOK with the 2 new
   commerce-arm entries. Same convergence pattern as `commercial_document`
   (which both `account.move` and `sale.order` resolve to). No new
   ConceptDomain variant — both stay in Commerce (0x02XX).

2. Workspace Cargo.lock: bump pinned OGAR crates
   (ogar-vocab / ogar-class-view / ogar-ontology / ogar-adapter-surrealql)
   from `08a9c979` → `ac4b4162` (current OGAR main, post-#111 merge).
   4 references in this lock.

Safe SHA swap verified: Cargo.toml deps for all four OGAR crates are
byte-identical between the two commits (`git diff 08a9c979..ac4b4162
-- crates/{ogar-vocab,ogar-class-view,ogar-ontology,
ogar-adapter-surrealql}/Cargo.toml` returns EMPTY).

Tests:
  - lance-graph-contract: 9 doctests pass (compile-time COUNT_FUSE passes)
  - lance-graph-ogar lib: 53/53 pass including
    parity::tests::mirror_is_a_faithful_copy_of_ogar_codebook
  - cargo build -p lance-graph-ogar: clean

Closes the cycle named in E-OGAR-AUTH-MIRROR-DRIFT (lance-graph #596 /
sibling-merged as #595/81d08c42): mirror updates must land in the SAME
commit as any OGAR-side ALL-list extension. This PR demonstrates the
discipline working — OGAR #111 merged this morning, the mirror catches
up this afternoon (instead of three days later when q2's lock bumps).

Source-of-finding:
  - AdaWorldAPI/OGAR#111 (introduced PRODUCT + ACCOUNTING_ACCOUNT)
  - AdaWorldAPI/odoo-rs#14 (the upstream finding: 11 missing OdooPort aliases)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: claude

Cargo.lock

@@ -287,6 +287,13 @@ pub const CODEBOOK: &[(&str, u16)] = &[
     ("billing_party", 0x0204),
     ("payment_record", 0x0205),
     ("currency_policy", 0x0206),
+    // Phase-3 mints per OGAR PR #111: both product.template / product.product
+    // and account.account / account.account.template converge on these two
+    // canonical concepts (same convergence pattern as account.move ↔ sale.order
+    // → commercial_document). Closes the cross-axis identity gap surfaced by
+    // odoo-rs PR #14.
+    ("product", 0x0207),
+    ("accounting_account", 0x0208),
     // ── 0x09XX — Health domain (MedCare; OGIT NTO/Healthcare promotion) ──
     ("patient", 0x0901),
     ("diagnosis", 0x0902),