U6: Add exact, provider-authorized project discovery

[blackforestboi]

Implements U6 of the implementation plan.

Depends on U0, U3, U5. Combine supported thread roots with user-enrolled roots, filter by project grant, report source/completeness, and validate projectRef byte-for-byte without mapping.

Requirements: R6, R7, R13, R15. Exit: stale, deleted, symlinked, unauthorized, and first-handoff roots work without Desktop scraping.