feat(decision-capture): log the surviving silent suppression (bug 011 option 4)

[Kyarha]

additive observability only, fix class still the maintainer's — @ramboz to validate before merge.

Implements bug 011 option 4 (suppression logging), the piece #109 finding 2 left on the table. Follows #117, which decided the fix class and removed dropping on both recorded-corpus paths.

Why this exists after #117

#117 deliberately kept one drop: decision_scratch.dedup_scan_against_stubs. Its own residual 1 documents the consequence — a Tier-3 agent reversal of an in-flight stub is still silently dropped there, since agent prose never produces a stub of its own to survive as. On disk, that drop was indistinguishable from "nothing was found." Bug 011's record even overclaimed "no silent suppression remains to log" — this corrects that.

So the original A4 scope (dedup() / prune_recorded_stubs()) collapsed: #117 turned both into flags that surface, so there is nothing silent left to log there. The one surviving silent drop is the only thing worth instrumenting, and this PR instruments exactly it.

The change

dedup_scan_against_stubs	on each drop, appends one JSON line to .jig/decision-suppressions.log (dropped candidate quote/tier/who, covering stub, containment score, call site). The drop is unchanged — same rule, same result, logging is a gated side-effect.
decision_scan.containment()	new measure returning the raw score; is_contained is now a threshold over it, so the number that decides a drop and the number logged share one home.
logging contract	fail-open (a broken sink never changes what is suppressed) and opt-in via project_dir — pure-function callers log nothing and behave identically.
.gitignore	ignores the new log, matching the decision-scratch precedent (jig-local runtime state, per-checkout, never tracked).
bug 011 record + refinement-todo #255	overclaim corrected inline; ## Amendments note added; residual gains an observability line. Fix class stays deferred.
hosts/ (claude + codex)	regenerated.

Scope guardrails (out of scope, on purpose)

• Does not touch the drop. What surfaces and what is pruned is byte-for-byte unchanged.
• Does not decide the fix class. Whether dedup_scan_against_stubs should drop at all stays the maintainer's call — this removes the silence, not the residual. Bug 011 stays DONE; the residual stays a residual.

Test evidence (red → green, TDD)

Red — the drop happened, no log existed:

TypeError: dedup_scan_against_stubs() got an unexpected keyword argument 'project_dir'
AttributeError: module 'decision_scratch' has no attribute 'suppression_log_path'

Green after implementation:

• test_decision_scratch.SuppressionLogTests (4): a drop writes one inspectable line; a kept candidate logs nothing; logging is opt-in (no project_dir → no write, unchanged behaviour); a broken log sink never changes what is dropped (fail-open).
• test_jig_decision_capture.py (+2, end-to-end through the real Stop hook): the dedup drop writes a suppression line naming dedup_scan_against_stubs; a plain surfacing with no drop writes no log.
• Full decision suites green: test_decision_scan + test_decision_scratch (73), inflight hook (12), capture hook (13). Ruff clean. Validated on Python 3.9.6.

The one drift-guard flake on hosts/claude/.claude-plugin/plugin.json is the known, pre-existing intermittent one (docs/bugs/008) — that file is untouched here and clean in the tree.