fix(portfolio): canonicalize collision warnings

[saagpatel]

Summary

• derive checkout-authority warnings from the canonical, origin-sorted collision summary
• keep warning text deterministic when filesystem discovery order differs
• add a regression with deliberately unsorted collision origins

Causal evidence

The documented activation rehearsal at 2026-08-05T09:31Z passed producer and receipt gates, then failed closed with PortfolioTruth warnings differ from producer facts. Live inspection showed the same 30 ambiguous origins in both inputs, but discovery order differed from the canonical summary order. No digest or Bridge action ran.

Verification

• focused regression and baseline: 2 passed
• full suite: 3500 passed, 2 skipped
• Ruff: pass

Safety

No collision is added, removed, selected, or made green. The repair only derives warning serialization from the snapshot’s own canonical facts.