Canonicalize edit operations at ingress

[isty2e]

Summary

• introduce a canonical EditOperation that validates target and operation combinations at construction
• keep wire-format flexibility in changeset::wire, then normalize once before execution
• make ChangeOp fields private and expose invariant-preserving constructors, accessors, and mutators
• centralize preview-family and same-file move destination validation in the changeset model
• remove duplicate target/operation compatibility checks from transform execution

Compatibility

Valid changesets retain the same JSON shape and round-trip field-for-field. Existing empty move-preview placeholders remain accepted and normalize to the canonical move preview representation.

Invalid target/operation or preview-family combinations now fail during ingress normalization instead of later execution. They retain the invalid_request classification, but diagnostic wording may change and no longer includes the later execution-stage operation index.

Architecture

• canonical flow: wire DTO -> EditOperation::try_new -> ChangeOp::try_new -> execution
• invariant owner: changeset model-local algebra
• boundary owner: changeset::wire
• I/O and transaction sequencing remain outside the canonical model

Public graph

• externally public Rust symbols added: none; the package remains binary-only
• internal symbols added: EditOperation, OperationModelError, and FileMoveOperationRef
• direct ChangeOp field access removed in favor of invariant-preserving methods
• cross-file dependency added: the application error layer converts OperationModelError into IdenteditError
• caller-facing CLI paths: unchanged for valid requests; invalid requests fail earlier

Verification

• cargo test --locked --all-targets --quiet (2,009 tests)
• cargo clippy --locked --all-targets -- -D warnings
• rustup run 1.88.0 cargo check --locked --all-targets
• cargo build --locked --release
• cargo fmt --all -- --check
• git diff --check main...HEAD

Residual risk

The compatibility target is exact parity for valid serialized changesets and behavioral parity for invalid requests. Exact error-message parity for invalid payloads is intentionally not preserved because validation now occurs at the canonical ingress boundary.