Harden check-chart-freeze.py: refuse non-deletions at ancestors of frozen paths and strictly validate --diff-file records #7391

Two hardening gaps in core scripts/check-chart-freeze.py (MeshWeaver#7194, head 5220ebc). Neither is reachable by a well-meant edit.

1. Ancestor replacement. Move deploy/aks to editable-aks, then add the symlink deploy/aks -> ../editable-aks. The diff shows the frozen children as deletions and an addition at deploy/aks, which no frozen prefix matches. The gate should refuse a non-deletion at an ANCESTOR of a frozen path, keeping the EXEMPT entries (deploy/build-host/, .github/scripts/build-run.py).

2. --diff-file strictness. R100\0docs/x.yaml\0 (a missing destination) and Dgarbage\0deploy/helm/values.yaml\0 (read as a deletion) both return zero violations. Validate the whole status token, and the count and non-emptiness of the path fields, before processing a record.

Context: #7127 already deleted every frozen path from core main, so nothing is behind these gaps today. The --base path reads git directly.

Context: Copilot threads 4370928497 and 4370928513 on #7194. Answered on each thread without a push.
Origin: https://memex.systemorph.com/Feedback/_Submissions/fb-fdd68cecab9c03a3da55ee1e5e5678e9 (submitted on memex.systemorph.com)

filed by the triage agent on behalf of Roland Bürgi via systemorph-com

Triage routing: filed in Systemorph/MeshWeaver — agent: Systemorph/MeshWeaver — The feedback names #7194 (head 5220ebc) and the in-repo script core scripts/check-chart-free.py at that head; no mesh Space is GitSynced from the feedback's node, so the owner is the repository the feedback names directly..