…hema.sh — pre-push compat

Default mode (full-tree) is unchanged — manual runs and full-
tree audits work as before.

New --files PATH... mode restricts the check to the listed
shard files. Shape that pre-push hooks and per-PR CI jobs
want, so they can run only on changed shards instead of
failing on the 5 known-stale shards documented in the script
header. Non-shard paths in the argument list are silently
skipped, so callers can pass a broader file list (e.g. all
changed files from `git diff --name-only`).

Refactor: extracted the per-shard validator into scan_one()
function; replaced `continue` with `return 1` for early-exit
semantics that work both inside the find loop and inside the
--files iteration.

Composes with B-0114 sub-item 1 (pre-push lint hook) — the
--files mode is what that hook will invoke.

Stacks on #975 (the original DORMANT-mode landing).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…review

Three substantive findings from the chatgpt-codex-connector +
copilot-pull-request-reviewer review pass on PR #977:

1. P2 (Codex) — six-column row enforcement. The col1 regex
   only validated col1 + the col1-end pipe; rows with too few
   columns (e.g. `| <ts> | a |`) passed. Added explicit pipe-
   count check via awk that requires ≥7 pipes (= 6 columns +
   trailing pipe). Runs before the col1 regex; col1 check
   only fires if column count is right.

2. P2 (Codex) — HHMMSSZ filenames must require the hash
   suffix. The `(-[0-9a-f]+)?$` made the suffix optional,
   so `111122Z.md` would pass even though the schema documents
   `HHMMSSZ-<hash>.md` with hash REQUIRED for collision-
   avoidance under high-concurrency writes. Made the hash
   non-optional in the HHMMSS branch.

3. P2 (Copilot) — header contract said non-shard paths "silently
   skipped" but the code emitted `skipped (not a file): ...`
   to stderr. Removed the stderr message to match the contract.

Two findings left as form-2 closures (false positives):

- P0 (Copilot) — case glob doesn't span YYYY/MM/DD depth.
  False: bash case patterns `*` matches `/`. Verified by
  running --files with a real 4-level path; matched
  correctly. Added a comment explaining the bash-case-glob
  semantics so future readers don't re-flag.

- P0 (Copilot) — col1 regex requires "two spaces after |".
  False: trailing whitespace before `]]` is regex delimiter,
  not part of the pattern. Verified the regex matches single-
  space shards (the actual on-main format).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>