Implements docs/RFC_incremental_v2.md section 3.5.2's P3-2 slice in reclaim.py:
the leveled sibling of verify_target(), so a Phase-3 leveled-incremental
target's delta-level run-logs no longer perpetually false-DRIFT once the
first delta ships.

New in reclaim.py:
  - is_leveled_manifest(m): discriminates a Phase-3 manifest (schema
    "leveled_v1" / a "levels" list) from a Phase-2 size-routing manifest
    (flat "objects" list).
  - verify_chain(manifest, holds, log_dir, ...): reconstructs the expected
    state via archive.effective_catalog (L0 union deltas, add/modify applied,
    deletions removed) rather than a per-log member set; requires every
    level's non-null fortress_tar present on tape (any missing one becomes
    FAILED "chain is broken - not restorable", never a partial SAFE);
    per-arcname newer-than-archived is judged directly against the
    reconstructed catalog's own (mtime,size), floor_s on both sides, matching
    decide_level's own comparison. Same verdict cascade and INV-E exclusion
    re-gate as verify()/verify_target().
  - manifest_for_project fix: a badge mid-conversion from Phase-2 to Phase-3
    can have both a routing manifest and a leveled manifest for the same
    project at once (the whole point of manifest_path's kind= split). Glob
    order doesn't reflect which is current, so this now deterministically
    prefers the leveled manifest when both exist.

--scan wiring: the existing routed_object per-log skip now also skips
leveled_object logs (delta/NO-OP level logs, covered by their manifest
instead); find_manifests() results are split into non-leveled
(verify_target, unchanged) and leveled (verify_chain) sets, and the --match
scope filter covers both.

Bug found + fixed along the way: archive.write_level_catalog's sibling
catalog sidecar files live directly in log_dir next to real run-logs (by
design, so effective_catalog can resolve a relative catalog_ref) - but
find_logs' bare *.json glob also matched them (no "project"/"status"
fields), surfacing as a bogus [FAILED] None entry in every --scan report
once any target uses leveled incrementals. Fixed by excluding
*.catalog.json from find_logs' glob.

Tests: new tests/test_leveled_reclaim.py (21 tests) covering
is_leveled_manifest, verify_chain's full verdict cascade (SAFE
baseline-only, SAFE across a real L0+delta chain, DRIFTED via
count/bytes/newer/INV-E, FAILED via a missing intermediate tar and via no
levels, GONE, HOLD, CANONICAL), manifest_for_project's Phase-2/Phase-3
disambiguation, and an end-to-end --scan integration test proving a
leveled_object log is skipped and its target instead gets one aggregate
verdict from verify_chain while an unrelated legacy project's log still
flows through verify() unaffected. tests/test_routing_reclaim.py is
untouched. Full suite: 371 passed (350 existing + 21 new), zero
regressions.

P3-3 (restore.py leveled support) is a separate follow-up slice per the
plan, not part of this change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Implement full/point-in-time restore for a Phase-3 leveled-incremental
target, per docs/RFC_incremental_v2.md §3.4 and the plan's P3-3 table.

New in restore.py (Phase-2 restore_target/select_objects/CLI path untouched):
  - select_chain(manifest, to_quaver=None): L0 + its deltas (parent_blonde ==
    current_l0_blonde), sorted by quaver, optionally cut off at a point in
    time (mirrors archive.effective_catalog's upto_quaver exactly).
  - check_chain_complete(chain): gate BEFORE any transfer -- every non-null
    fortress_tar in the chain must be on tape, else "chain is broken", never
    a partial restore.
  - extract_level(node, dest, tmp_dir): Path A extraction -- hsi get -> tar xf
    -> zipfile.ZipFile(...).extractall(dest); extractall's overwrite-same-name
    behavior on the accumulating tree IS the overlay.
  - apply_deletions(node, dest): idempotent removal of a level's recorded
    deletions.
  - fold_expected(manifest, log_dir, to_quaver=None): the mandatory final-
    reconciliation target, via archive.effective_catalog's own L0+delta fold
    -- the same fold decide_level diffs against and reclaim.verify_chain
    reconstructs from.
  - verify_level_members(node, dest, log_dir): per-level MD5 verify against
    that level's own run-log (object_runlog_checksums reused verbatim).
  - restore_leveled_target(...): orchestrates the RFC §3.4 gate order exactly
    -- select_chain -> check_chain_complete -> check_dest -> per-node
    extract+verify+apply_deletions (deletions-only nodes skip extraction
    entirely) -> final walk_restored(dest) == fold_expected(...) or ABORT.

CLI: main() now resolves a config to whichever manifest schema the target
was actually archived with (reclaim.manifest_for_project, reusing P3-2's
leveled-preference fix) and dispatches on reclaim.is_leveled_manifest;
added --to-timestamp for point-in-time restore. --slot/--member remain
Phase-2-only (rejected for a leveled manifest with a clear error).

New tests/test_leveled_restore.py (8 tests), reusing test_restore.py's
fake_extract-closure/hsi_exists-monkeypatch conventions and
test_leveled_reclaim.py's manifest-fixture style: full L0+2-delta chain
restore (incl. a real deletion) reconstructs the exact tree; a missing
intermediate tar aborts before any extraction; a deletions-only node
applies its removal with zero extractor calls (asserted explicitly); a
per-member MD5 mismatch aborts; a final-reconciliation mismatch aborts
(a stray file no per-level check catches); --to-timestamp stops the chain
at the right point; a non-empty dest is refused; an empty-levels manifest
aborts cleanly.

Full suite: 379 passed (371 existing + 8 new), zero regressions.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

The branch was based on e41a772, one commit behind origin/main. Without
this merge, HSI_PATH_DIRS and the regression test
test_fake_binaries_win_even_when_host_has_real_hsi_bin_dirs were absent
from this branch's tree, and the local suite run was exercising the old
inline ship_object PATH literals instead of the fixed version.

Fixes confirmed bugs and invariant violations from the Opus/fable-5 review of
feat/phase3-leveled-incremental, plus in-scope deviations from the plan:

- reclaim.py: single-config invocation (`python reclaim.py config.json`) had
  no `incremental` branch and fell through to legacy per-log verify(), which
  perpetually false-DRIFTs/FAILs a leveled target. Now routes to verify_chain
  via the exact leveled manifest, mirroring the --scan path.
- archive.py (level_and_ship): the manifest catalog was built from the
  DECISION member set, not what actually shipped. make_zip_files silently
  drops any only_arcnames entry that vanished between enumerate and zip, so a
  race could poison the manifest with a file never on tape, permanently
  breaking restore.verify_level_members for that chain. ship_level now
  reports the zip's real namelist (zip_members); level_and_ship builds the
  catalog from it and raises immediately on any discrepancy instead of
  silently recording a phantom member.
- restore.py: config-mode manifest lookup used manifest_for_project (matches
  by project-name substring across the whole vault), which could silently
  resolve to the WRONG target's manifest when two configs share a
  project_name but differ in source_folder/file_pattern (distinct badges).
  Now resolves by the config's own exact badge, preferring the leveled
  manifest, matching manifest_for_project's tie-break without widening the
  match.
- reclaim.py (verify_chain): the tape-completeness gate checked EVERY tar in
  manifest["levels"], including an older, superseded L0+deltas left behind by
  a --full rebaseline. Scoped to the current chain only (matching
  effective_catalog/select_chain's own node set) so a superseded chain's tar
  going missing (once tape pruning exists) can't false-FAIL a target whose
  restorable chain is intact.
- archive.py: the leveled NO-OP path fired the T1 "ACT NOW" Teams bell on
  every routine unchanged run; the bell is documented (CLAUDE.md) as reserved
  for FAILED/STALE/EXCLUSION-ABORT. Downgraded NO-OP to email-only.
- archive.py: send_to_fortress now returns the retrieved tar's on-tape size
  (tar_bytes) instead of always None on the leveled path (RFC §3.3 reclaim-
  readiness field).
- archive.py: send_to_fortress gained quiet_success= to suppress its own
  completion email for leveled ships, since __main__'s incremental branch
  already sends one summary email per run (was doubling up).
- archive.py: L0 leveled ships now attempt find_existing_zip resume (only
  L0 — deltas still always re-zip fresh by construction), closing an
  operational-cost regression where a failed L0 upload on a multi-TB pilot
  target would re-zip the entire source on every retry. Staleness decision
  factored into a pure, unit-tested l0_zip_is_stale() using the survivor
  catalog already in hand.
- restore.py: verify_level_members now raises a named RestoreError (not a
  raw FileNotFoundError) if a level's sibling catalog_ref file is missing.
- Merged origin/main (f4be033) — the branch was one commit stale, and its
  diff against origin/main was silently reverting the HSI_PATH_DIRS
  PATH-shadowing decoy-binary fix and its regression test.
- Documentation: module docstring (archive.py), CLAUDE.md (config key table +
  new "Leveled incremental (Phase 3)" section), config.example.json, and
  RFC_incremental_v2.md §3 status header now reflect the shipped feature
  instead of reading DEFERRED/undocumented.

Findings reviewed but not changed:
- P3-1 manifest schema doc gaps were closed above rather than left as a
  follow-up.
- Documentation of Phase-3 in CLAUDE.md/RFC previously described the feature
  as deferred; this is now corrected in the same change rather than deferred
  further.

Full suite: 392 passed (was 384 pre-fix; +8 new/expanded test cases).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>