Warn about unknown nested Project source-policy keys

[ian-pascoe]

What to build

Surface path-qualified diagnostics when a Project configuration contains unknown keys inside its source inclusion and exclusion policy, while retaining the existing forward-compatible treatment of unknown configuration data.

Acceptance criteria

• Unknown nested source-policy keys produce warnings that identify the full configuration path.
• A misspelled exclusion key cannot be silently mistaken for an active exclusion.
• Valid source policies retain their current discovery behavior and produce no new diagnostics.
• Unknown keys remain preserved in the committed configuration because Antisprawl does not rewrite them.
• Tests cover root and nested unknown keys alongside valid inclusion and exclusion settings.
• The full verification command passes.

Blocked by

None (can start immediately).