feat: raw capture / raw status / --replaces-bundle - documentation from git repositories as a bundle, with drift reporting (#177)

New repo_capture module: resolve a branch or tag-pattern ref rule, fetch it
shallowly by name into a bare cache, read the glob-selected files as blobs,
and record repo/ref/commit/globs/capture fields in _capture.json. raw status
reports changed captured bundles as A/M/D; raw accept --replaces-bundle swaps
a captured bundle for its new edition at the same address. iter_raw_files now
skips _capture.json and anchors the CONTRACT.md exclusion to raw/CONTRACT.md.

Files changed:
- .gitignore
- CHANGES.md
- README.md
- VERSION
- instructions/wiki-ingest/SKILL.md
- raw/CONTRACT.md
- tools/CONTRACT.md
- tools/README.md
- tools/chemenu/cli_contract.py
- tools/chemenu/commands/dist_cmd.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/raw_cmd.py
- tools/chemenu/config.py
- tools/chemenu/repo_capture.py
- tools/chemenu/tests/test_cli.py
- tools/chemenu/tests/test_raw_capture.py

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2

instructions/wiki-ingest/SKILL.md

@@ -107,7 +107,8 @@ validator complains - and the ticked list is the only record that they happened.
    (`work new --input <path>`) refuses any path outside `raw/`, so the hand-off needs the
    material already promoted; there is no later point at which this skill still controls the
    file. Ask `--fidelity`/`--authority` immediately, with the same posture step 5 states below,
-   and run `raw accept` before switching over. This does not weaken the property step 5 exists
+   and run `raw accept` before switching over - a folder `raw capture` wrote takes neither flag
+   (step 5). This does not weaken the property step 5 exists
    for: a large-tree run is not atomic - it publishes unit by unit over days, and asks its own
    commitment question per unit, in that procedure's step 5d, long after this promotion. The
    raw-file-without-page state that stands until then is the one `sources coverage` and `lint`
@@ -230,6 +231,12 @@ validator complains - and the ticked list is the only record that they happened.
    A file inside a subdirectory of `incoming/` is refused on its own - the subdirectory is the
    source.
 
+   **A folder with a `_capture.json` at its top was written by `raw capture`** - documentation
+   from a git repository (`raw/CONTRACT.md` "Getting a repository in"). Its capture fields were
+   asked when it was captured and sit in that manifest: accept it with neither flag,
+   `tools/wikitool raw accept incoming/<bundle>`, which refuses them. `_capture.json` goes in no
+   `raw_files:`; the success message already leaves it out.
+
    **A file that arrived through the MCP `submit` tool is not yet in `incoming/`** - it sits in
    `mcp-upload/<id>/`, a quarantine no command in this step reads. A reviewer promotes it first
    with `wikitool upload accept <id> --confirm <token>`, per
@@ -329,7 +336,9 @@ validator complains - and the ticked list is the only record that they happened.
    While drafting, cite every hard fact - an IP, port, version, path, command or config value -
    with `tools/wikitool cite add --page "<Name>" --source "Source - <Title>"`, which mints the
    `[^cite-id]`, upserts its Footnotes definition, and adds the source to `sources:`; paste the
-   marker it prints at the fact.
+   marker it prints at the fact. Citing one file of a captured bundle, pass `--file` with its path
+   inside the bundle (`--file docs/runbook.md`), never its base name - a repository has a
+   `README.md` in many directories.
 
 8. **Create or update concept pages** - only if the source produced any. Same pattern, including
    step 7's rule about which subjects earn a page at all, reading
@@ -399,6 +408,14 @@ validator complains - and the ticked list is the only record that they happened.
 - **One source names far more subjects than usual?** That is breadth, not volume. It is not
   split into several sources - it cannot be - and it does not get a page per name either:
   `instructions/ingest-large-tree.md` § A broad source is not cut.
+- **The entry is a new edition of a captured bundle?** `raw status` reported it, `raw capture
+  --update` wrote it, and `raw accept incoming/<bundle> --replaces-bundle <raw-bundle>` takes it
+  in - the name refusal above does not apply to it. Read the edition diff with `git diff` on the
+  bundle, update every page the output lists under the changed files' source page, and carry the
+  `A`/`D` lines out with the `touch --page "<Source page>" --add/--remove raw_files=<path>` lines
+  it prints - a new file may instead earn a source page of its own. A source page left with no
+  raw file is retired by `instructions/page-lifecycle.md` § Delete. All of it goes into the one
+  commit with the replacement.
 - **No raw file backs a claim you want to write?** Leave it out, or mark the page
   `provenance: mixed` and put it under `## General Guidance (unsourced)`.
 - **`publish` exited 42?** A single ingest is normally well under the Mass-Update Gate
@@ -411,7 +428,7 @@ validator complains - and the ticked list is the only record that they happened.
 
 ## wikitool commands used
 
-`raw pending`, `raw fetch`, `raw accept`, `search`, `types describe`, `task new`, `task list`, `task close`,
+`raw pending`, `raw fetch`, `raw accept`, `raw status`, `raw capture`, `search`, `types describe`, `task new`, `task list`, `task close`,
 `new project`, `new source`, `new entity`, `new concept`, `touch`, `cite add`, `xref add`,
 `xref link-source`, `sources coverage`, `sources rebuild-index`, `index rebuild`, `log append`,
 `log status`, `publish`