feat(devx): a row selector for measure-self-test-floor --probe (#15759) (#15833)

* feat(devx): give `measure-self-test-floor --probe` a row selector (#15759)

`--probe` swept every census row twice and had no way to name ONE, so every
single-row reading on record was taken by re-driving `main()`'s loop in a
private throwaway -- a COPY of the decision (which row, which entry, which
budget) the shipped sweep makes.

`--only <path>` (repeatable, `--only=<path>` too, repo-relative or absolute)
selects census rows for the probe. Both paths run the same `population()` ->
`probePlan()` -> `probeEarlyReturn()` chain through `probeRows()`, which is the
sweep's own loop body LIFTED rather than copied -- the `sitesInSource` treatment
from #13874, so a single-row reading and the shipped sweep cannot drift.

- A selector naming no census row exits 2 and lists the nearest rows by path
  substring; a part every row carries is not scored. Never a silent empty sweep,
  whose `0 DEFEATED, 0 HELD, 0 ACCIDENT` is the flattering reading this
  instrument exists to expose.
- `--only` narrows the PROBE, not the census: the row count, the floor column
  and the handshake column stay whole, and hole 2 announces over how many of how
  many rows it was measured. Excluded rows publish `NOT PROBED` in `--json`.
- With no `--only` the sweep is handed the population object itself and every
  byte of the output is unchanged (measured: 17,516 bytes, `cmp` clean).
- Controls for all three cases, plus one that drives `probeRows` over a real
  fixture and compares its verdict against a direct `probeEarlyReturn` call --
  the anti-drift reading a private loop copy would break.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

* fix(devx): rank a failed `--only` selector by path, not by summed parts (#15759)

A per-part score ranked the right row first and then padded the list with every
row that merely ends in `.mjs` -- measured on this census, a single miss
"matched" 181 of 182 rows, and a diagnostic that names everything names nothing.

`nearestRows` now reads two tiers: rows whose path CONTAINS the whole selector
(a bare basename, a directory, a truncated prefix), and otherwise only the rows
sharing the LONGEST basename prefix with it -- the maximum, never a threshold.
`--only scripts/invoked-a.mjs` now lists exactly `scripts/invoked-as.mjs`.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]