Route B, step 1: hand-written axes list and the JSON options probe sweep #121

The first step of route B from #105 (the 2026-10-18 comment): no tooling, a hand-written axes list and probe classes as ordinary MSTest sweeps.

Scope

1. test/oracles/axes.md: one section per surface family of claims.json (literals and JSON; TypeConverter, configuration and web binding; EF Core; hosting and AOT). Per axis its values, the test that already varies it, and the pairs no test varies yet.
2. JsonOptionsProbeTests in the conventions project: every discovered range, multirange and value set type × how it is declared {union, sealed variant, IRange<T>/IValueSet<T> interface, object, property of a record, dictionary value} × JsonSerializerOptions {default, camelCase, snake_case, ReferenceHandler.Preserve, a source-generated context, NumberHandling.AllowReadingFromString}. Oracle: the wire form is the type's literal (or array) and the round trip is the same value, or the refusal docs/serialization.md promises. Disagreements go through Candidates.Verdict.
3. Registered in oracles.json, named in the heldBy of the J* claims it holds, with a seed under test/oracles/seeds/ proven by dotnet run tools/oracles.cs seeds.
4. Any disagreement that is not a harness mistake becomes a candidate with its own issue (bug, found-by/oracle).

Why

#114, #116 and #117 were each found by a one-off combination of consumer settings that no test kept. The probe sweeps keep the product.