feat(explain): complete ATLAS-WP-0004 — graph edges, blast-radius, determinism tests

T05: tests/test_effective_config.py (6 tests) — order-independence, most-specific
winner, no value/secret leak; wired into make validate + CI.
T04: tools/blast_radius.py + make blast-radius — consumers, transitive dependents
(cycle-safe), secret refs, fan-out risk band.
T03: tools/config_graph.py + make graph/graph-query — emit config-typed edges to
registry/indexes/graph.yaml (queryable by surface id); staleness check in the gate.

WP-0004 finished (5/5). Read-first control-plane MVP complete: explain, graph,
and blast-radius over the seeded surfaces.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

registry/indexes/graph.yaml

@@ -0,0 +1,65 @@
+version: 1
+generated_by: tools/config_graph.py
+note: config-typed edges emitted from surface relations; ingest into the State Hub
+  graph (it owns storage).
+summary:
+  nodes: 10
+  edges: 10
+nodes:
+- id: secret:ops-bridge/ssh-cert
+  type: secret
+- id: secret:state-hub/database-url
+  type: secret
+- id: service.ops-bridge
+  type: service
+- id: service.reuse-surface-hub
+  type: service
+- id: service.state-hub-api
+  type: service
+- id: service.warden-cli
+  type: service
+- id: surface.infotech.ops-bridge.tunnel-config
+  type: surface
+  kind: infra-state
+  owner: ops-bridge
+- id: surface.infotech.ops-warden.routing-catalog
+  type: surface
+  kind: policy
+  owner: ops-warden
+- id: surface.infotech.reuse-surface.federation-sources
+  type: surface
+  kind: app-config
+  owner: reuse-surface
+- id: surface.infotech.state-hub.api-config
+  type: surface
+edges:
+- src: surface.infotech.ops-bridge.tunnel-config
+  type: consumed_by
+  dst: service.ops-bridge
+- src: surface.infotech.ops-bridge.tunnel-config
+  type: depends_on_secret
+  dst: secret:ops-bridge/ssh-cert
+- src: surface.infotech.ops-bridge.tunnel-config
+  type: related_to
+  dst: surface.infotech.state-hub.api-config
+- src: surface.infotech.ops-warden.routing-catalog
+  type: consumed_by
+  dst: service.warden-cli
+- src: surface.infotech.ops-warden.routing-catalog
+  type: related_to
+  dst: surface.infotech.state-hub.api-config
+- src: surface.infotech.reuse-surface.federation-sources
+  type: consumed_by
+  dst: service.reuse-surface-hub
+- src: surface.infotech.reuse-surface.federation-sources
+  type: related_to
+  dst: surface.infotech.state-hub.api-config
+- src: surface.infotech.state-hub.api-config
+  type: consumed_by
+  dst: service.state-hub-api
+- src: surface.infotech.state-hub.api-config
+  type: depends_on_secret
+  dst: secret:state-hub/database-url
+- src: surface.infotech.state-hub.api-config
+  type: related_to
+  dst: surface.infotech.ops-bridge.tunnel-config