dir-core: identity rules, witness evidence, and the ruler fold

Hybrid identity correspondence across AD, Entra and Exchange Online,
as numbers, without merging nodes.

- identity: IdentityRule (declaration) + CompiledRule (numeric slots).
  Encodings MsGuidBytes16 / Base64MsGuidBytes16 / Labeled / GuidText,
  strict (renders back or refused), absent / malformed / nil kept apart.
  Rules: ConsistencyGuid -> ImmutableId, objectGUID -> ImmutableId
  (separate profile, no fallback), backsync -> Entra id,
  Entra id -> EXO ExternalDirectoryObjectId.
- edge: EdgeEvidence codes 2-4; code 1 keeps its objectGUID meaning.
- schema: SchemaFamily::ExchangeOnline = 3 (additive).
- correspond: Lanes (boundary decode, once), sort-merge join fold
  (puts unaligned observations onto the ruler, cold), and fold_aligned:
  slot i is the same user in every column, so each witness is a
  position-wise compare into bit planes. Ambiguous or contested
  counterparts never reach the ruler.
- ogar-az sync_edges documented as the objectGUID profile only.
- dir-sim SourceAnchor::from_immutable_id reuses the dir-core codec.

Tests: F1-F14 through the real ogar-ad / ogar-az encoders, plus a
3,000-world randomized comparison with an independent reference that
also checks the ruler fold against the join slot by slot.

Bench (1,048,576 slots, release, one thread, Xeon 2.1 GHz):
ruler fold 8.2 ms median, 0 allocations; join fold 200 ms;
Guid128 equality 1.2 ms; HashMap lookup baseline 95 ms.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

Author: claude

crates/ogar-az/src/lib.rs

@@ -514,6 +514,12 @@ pub fn attr_multi<'p>(rec: &DirRecord, pool: &'p ValuePool, name: &str) -> Optio
 /// `SynchronizesTo` edges for AZ records whose `onPremisesImmutableId`
 /// base64-decodes to the `objectGUID` of an **observed** AD object.
 ///
+/// This is the `objectGUID` anchor profile only. A deployment whose source
+/// anchor is `mS-DS-ConsistencyGuid` (which may differ from `objectGUID`)
+/// gets no edge here; use `ogar_dir_core::correspond` with
+/// `identity::CONSISTENCY_GUID_TO_IMMUTABLE_ID`, which also reads the
+/// backsync and Exchange Online witnesses.
+///
 /// This is evidence, not a decision: anchors that are not a 16-byte GUID
 /// (e.g. custom source anchors) yield no edge, and an immutable id matching no
 /// observed AD object yields no dangling edge. The two nodes stay distinct.