Honour .reference.yaml exemptions in just check

What does this MR do and why?

conformance-config says a FAIL matching an exemptions: entry is reported as exempt, but through v2.4.0 nothing read the list. An exempted standard printed FAIL and failed the run. This MR makes the runner do what the schema says. _fail() checks the entries contract loads from the project's .reference.yaml, which is the same routing point the advisory tier uses, so the closed primitive set is unchanged.

flowchart TD
  read["just check reads .reference.yaml"] --> valid{"Every entry readable and naming a known standard?"}
  valid -- no --> stop["Error naming the entry, exit 2, no standard runs"]
  valid -- yes --> run["Run the standard's check.sh"]
  run --> tripped{"Any assertion tripped?"}
  tripped -- no --> declared{"Standard has an entry?"}
  declared -- no --> pass["PASS"]
  declared -- yes --> unused["PASS, plus NOTE: exemption unused"]
  tripped -- yes --> covered{"Every tripped assertion covered by an entry?"}
  covered -- no --> fail["FAIL, run exits 1"]
  covered -- yes --> exempt["EXEMPT, plus the entry's reason"]

An entry scoped with assertion: covers that one assertion and no other. SUMMARY gains , N exempt, and TOTAL reads N standard(s) passed, N exempt, N failed.

References

standards/conformance-config/SKILL.md, "How a checker reads the file", now carries the reporting table.

Standards affected

No standard's assertions or tier change. The docs for conformance-config, the exemptions page, README and ARCHITECTURE describe the reporting. The assertion: example there, file-contains:LICENSE:^MIT, matched no real id and now reads file-contains:LICENSE.

Exemption implications

Consumers run just check from a reference checkout at their pinned reference_version, so a project picks this up when it moves to the release that carries it. The parser reads every entry in the estate's .reference.yaml files. It refuses entries in only two projects, both on the pre-v2 schema (until:, owner:) and pinned to v1.x.

Test plan

• New scripts/validate-exemptions.sh, run by just validate, covers six fixture cases: exempt and failing, exempt but passing, scoped, all exempt, unknown standard, and flow-style refusal. At origin/main all six fail; on this branch all pass.
• Consumers at origin/main, checked from this branch, all exit 0. Each exited 1 before the change.
  • p1-vp-generator: TOTAL: 20 standard(s) passed, 1 exempt, 0 failed
  • p1-vp-vexer: TOTAL: 20 standard(s) passed, 1 exempt, 0 failed
  • a third consumer: TOTAL: 19 standard(s) passed, 2 exempt, 0 failed
• The test and self-conformance pass in the CI alpine:3.24 image.
• just ship is green, and self-conformance reports 21 standard(s) passed, 0 exempt, 0 failed.