feat(explain): complete ATLAS-WP-0004 — graph edges, blast-radius, determinism tests

T05: tests/test_effective_config.py (6 tests) — order-independence, most-specific
winner, no value/secret leak; wired into make validate + CI.
T04: tools/blast_radius.py + make blast-radius — consumers, transitive dependents
(cycle-safe), secret refs, fan-out risk band.
T03: tools/config_graph.py + make graph/graph-query — emit config-typed edges to
registry/indexes/graph.yaml (queryable by surface id); staleness check in the gate.

WP-0004 finished (5/5). Read-first control-plane MVP complete: explain, graph,
and blast-radius over the seeded surfaces.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/validate.yml

@@ -18,5 +18,7 @@ jobs:
         run: pip install --quiet pyyaml jsonschema
       - name: Validate surface entries against schema + index
         run: python3 tools/validate_registry.py
+      - name: Resolver determinism + no-value-leak tests
+        run: python3 -m unittest discover -s tests -q
       - name: Check whitespace / conflict markers
         run: git diff --check $(git hash-object -t tree /dev/null) -- .