docs(fiqh): the fiqh basis document — every encoded ruling, sourced (#288)

[eaitbrahim]

Closes #288.

What & why

A Muslim developer deciding whether to trust keel with money asks a question the code cannot
answer by being read: WHAT fiqh does this machine enforce, and where did each ruling come
from? The answers exist — scattered across guard comments, a KB the size of a bookshelf, and
a handful of experiment records — auditable in principle, auditable by nobody who does not
already know where to look.

This PR adds docs/fiqh-basis.md: the Shariah reasoning encoded in keel, stated ruling by
ruling, each with its in-repo source — the curation screen (sector §28.4, backing
§65.5/§67.2, pays_yield bare-holder semantics, wrapper §71.4a), rail 1 allowlist
enforcement, rail 17 qabd §65.4 (Ayub quoted verbatim, tri-sourced §65.4 · §67.1 OIC
53/4-6 · §71.5 AAOIFI SS 18 3/5, 7-day TTL, entries-only, fails closed), rails 18/19 as
charter, purification §65.9 and USDC-rewards §56.3 — plus what is attested versus computed,
what keel deliberately does not decide, the known open questions (ATOM dilution, staking
§65.14 contested, DOGE §86.4), and how to disagree. The remaining rails are marked
PRUDENTIAL-not-fiqh with §65.6's anti-scalping correction stated in the KB's own words.

The document claims no scholarly review; that is deliberately #289's still-open question.

README's documentation map and CONTRIBUTING's governance section each gain one link line.

Tests-first evidence

tests/test_fiqh_basis.py written first; the document did not exist.

Red run (uv run pytest tests/test_fiqh_basis.py -q):

FAILED tests/test_fiqh_basis.py::test_the_document_exists - AssertionError: d...
FAILED tests/test_fiqh_basis.py::test_the_boundary_sentence_is_stated_verbatim
FAILED tests/test_fiqh_basis.py::test_the_qabd_condition_is_pinned_three_sided
FAILED tests/test_fiqh_basis.py::test_the_attested_never_inferred_split_is_pinned_two_sided
FAILED tests/test_fiqh_basis.py::test_the_fails_closed_posture_is_pinned_two_sided
FAILED tests/test_fiqh_basis.py::test_the_riba_failure_wording_is_pinned_two_sided
FAILED tests/test_fiqh_basis.py::test_the_bare_holder_semantics_are_pinned_to_the_experiment_record
FAILED tests/test_fiqh_basis.py::test_rail_17s_seven_day_ttl_is_pinned_to_the_executor
FAILED tests/test_fiqh_basis.py::test_the_prudential_rails_are_separated_from_the_fiqh_rails_with_the_65_6_correction
FAILED tests/test_fiqh_basis.py::test_the_atom_dilution_open_question_is_stated_not_hidden
FAILED tests/test_fiqh_basis.py::test_every_kb_citation_resolves_to_a_source_file_in_the_repo
FAILED tests/test_fiqh_basis.py::test_the_disagreement_section_names_the_local_attestation_route
FAILED tests/test_fiqh_basis.py::test_the_readme_links_the_document - Asserti...
13 failed in 0.07s

Every failure is the assertion it was written to be (the _doc() helper returns empty for a
missing file, so red is failures, not errors). After writing the document and the two link
lines: 13 passed.

Pins are TWO-SIDED per the house pattern (test_contributing.py): every verbatim quote is
asserted in the document AND in the file it quotes (guards.py, screen.py, KB sources,
experiment records) — the §65.4 qabd condition is pinned THREE-sided (doc + rail 17 + §65.4)
— so the document cannot drift from the code it explains. One extra source-normalisation was
needed: the riba failure message is two adjacent Python string literals, so the helper joins
implicit string concatenation before matching.

• Tests written first, seen failing for the right reason

Gates (all must pass)

• uv run ruff check clean — All checks passed!
• uv run mypy clean — Success: no issues found in 233 source files
• uv run pytest -q green — 2820 passed, 1 skipped in 34.75s

Scope check

• This PR touches a rail or a default classification — this PR adds documentation and
  tests only: no classification, no mechanism, no rail semantics change. One pre-existing
  inconsistency noticed and deliberately NOT fixed here (separate concern): README says
  "nineteen deterministic checks" / "the 19 rails" while guards.py's docstring and this
  document say eighteen (there is no rail 15).
• New dependency added