core: list the subjects in the report

[jbpros]

First of three PRs for #244 (decision 6 there). A report now says where each subject comes from: a top-level subjects section, and subject on each requirement.

With this input:

{"deployments": [
  {"id": "d-1", "environment": "prod", "approved_by": "alice"},
  {"id": "d-2", "environment": "staging"}
]}

and this policy:

subjects:
  deployment:
    description: Something we ship
    from: deployments
    identified_by: id
  prod deployment:
    from: deployment whose environment is "prod"
  release:
    from: releases
requirements:
  approved:
    subject: prod deployment
    checks:
      approved: approved_by is a non-empty string

the report has "subject": "prod deployment" on the requirement, and (from opa eval):

"subjects": {
  "deployment": {"description": "Something we ship", "from": "deployments", "identified_by": "id", "parts": {}},
  "prod deployment": {"description": "", "from": "deployment whose environment is \"prod\"", "identified_by": "id", "parts": {}}
}

• Which subjects are listed: the ones a requirement uses, plus any subject they narrow or descend from, all the way back. release isn't listed because no requirement uses it.
• from and identified_by are printed as sentences. A narrowing subject has the id of the subject it narrows.
• parts is always {} for now. The third PR fills it.
• Old syntax: a from written as a list is printed as its path, then whose and its applies_to filters sorted by name. Anything with no sentence form shows in angle brackets, so it's never left out: a filter with a custom operator or a substitute is <condition name>, a naming step with listed keys is <each of "a", "b">, and one with no keys is <each as it>. A naming step whose keys come from a ref prints as named by each of $params.suites.
• Written wrong: a from or id written wrong shows as <invalid from> or <invalid identified_by>, and the subject is still listed.

Changes the report: every report has subjects, and every requirement entry has subject.

Checks

• Every check in AGENTS.md passes: 1290 tests, no uncovered lines, 1118 spec cases.
• The JS Wasm runtime passes within its budgets: 12.4 MB and 10.6 MB.
• Reports from main and from this branch, on every spec case from main and every corpus line on two inputs (1740 reports), are identical once subjects and subject are removed.
• pr-reviewer's review-controls report takes 0.33 s against 0.32 s on main.
• I didn't run the Wasm suite in Docker.

🤖 Generated with Claude Code