feat(explain): complete ATLAS-WP-0004 — graph edges, blast-radius, determinism tests

T05: tests/test_effective_config.py (6 tests) — order-independence, most-specific
winner, no value/secret leak; wired into make validate + CI.
T04: tools/blast_radius.py + make blast-radius — consumers, transitive dependents
(cycle-safe), secret refs, fan-out risk band.
T03: tools/config_graph.py + make graph/graph-query — emit config-typed edges to
registry/indexes/graph.yaml (queryable by surface id); staleness check in the gate.

WP-0004 finished (5/5). Read-first control-plane MVP complete: explain, graph,
and blast-radius over the seeded surfaces.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/rules/stack-and-commands.md

@@ -23,6 +23,13 @@ reuse-surface validate --root .     # capability federation (from reuse-surface
 # Explain a surface's effective-config override path (no values shown)
 make explain SURFACE=surface.infotech.state-hub.api-config
 
+# Change blast-radius / dependency view for a surface
+make blast-radius SURFACE=surface.infotech.state-hub.api-config
+
+# Regenerate / query the config knowledge-graph edges (registry/indexes/graph.yaml)
+make graph
+make graph-query SURFACE=surface.infotech.state-hub.api-config
+
 # After workplan or registry edits — from ~/state-hub
 make fix-consistency REPO=config-atlas
 ```