…ce/extend/poison + mro rustfmt

Two codex P2 findings on merged #532 were real semantic bugs (live in main),
both producing a WRONG `ASSERT $value IN [...]` — the silent-data-rejection
class that matters for faithful DDL — plus a rustfmt miss on merged #533.

# #532 finding 1 — selection_add must not close a dynamic domain

A `Selection(selection_add=[('x','X')])` extension onto a base that is
DYNAMIC (`Selection(STATE_CONST)` / `selection='_compute_x'`) was emitting
`['x']` as if it were the complete closed set, so the projected
`ASSERT $value IN ['x']` would reject every legal base value.

# #532 finding 2 — full redeclarations must replace, not union

The cross-class merge unioned EVERY `fields.Selection` declaration, so an
`_inherit` class that REDECLARES the whole field with `selection=[...]`
(replace/reorder) left stale keys from the earlier definition in the set.

# The correct three-way semantics

`_extract_selection(call) -> (base_dynamic, base_keys, add_keys)`:
  - static `selection=`  → REPLACE (a redeclaration drops earlier keys)
  - `selection_add=`     → EXTEND  (unions across classes)
  - provided-but-dynamic → POISON  (sentinel `None`; never closed; sticky)

A closed `ASSERT IN` is emitted only when the whole domain is statically
known. Poison is recorded as `None` in the `selections` map and skipped at
emission (`selection_skip_open_domain` stat).

# #533 — mro.rs rustfmt

`mro.rs` landed un-`cargo fmt`'d (codex flagged the diff). Reformatted;
7/7 mro tests still pass.

# Tests

  python3 -m unittest tests.test_spo_enrich : 61/61 (was 57)
    + test_dynamic_base_plus_add_stays_poisoned   (finding 1)
    + test_full_redeclaration_replaces_not_unions (finding 2)
    + test_open_domain_none_emits_nothing
    + rewrote extraction tests for the (dynamic, base, add) contract
  cargo test -p lance-graph-ontology --lib mro : 7/7
  rustfmt --check mro.rs : clean

EPIPHANIES: E-ODOO-SELECTION-REPLACE-EXTEND-POISON.

)

Third codex P2 finding on this PR: my replace/extend/poison fix collapsed
the three into a single accumulated list DURING the scan, so under
glob.iglob's unordered file walk a `selection_add=` extension scanned
BEFORE the base `selection=[...]` was clobbered by the REPLACE assignment
— losing the legal added key, so the emitted `ASSERT $value IN [...]`
would reject it.

Fix: track replace / extend / poison SEPARATELY per `(model, field)` for
the whole scan, collapse only at the end.

  - `_new_sel_acc()` — per-field record `{replace, extend, poison}`.
  - `_scan_file` accumulates into it: poison sets the flag; a static
    `selection=` sets `replace` (last full decl wins, drops stale keys);
    `selection_add=` unions into `extend` and is NEVER overwritten by a
    replace.
  - `_resolve_selections()` (run once at the end of `build_all_facts`)
    collapses to the final domain: `None` if poisoned, else
    `replace ++ extend` de-duped, base first. Order-independent.

`enrich` is unchanged — it still receives the resolved
`Optional[List[str]]` map. `_scan_sel` test helper resolves before
asserting (mirrors `build_all_facts`).

Tests (61 -> 62): + `test_selection_add_before_base_is_order_independent`
(the EXTENSION class declared BEFORE the base; resolved domain still
[draft, posted, reviewed] regardless of order). All prior selection
tests still green.

  python3 -m unittest tests.test_spo_enrich : 62/62

EPIPHANIES E-ODOO-SELECTION-REPLACE-EXTEND-POISON updated with the
order-independence refinement.