Reconcile the workspace with the RFC after the simplification commit.
Two drifts addressed:

1. `path.base` now has a real `branch` field. The PR-shaped example
   fixtures originally carried both `ref:"main"` (branch) and
   `commit:"abc123…"` (SHA), but the simplified `Base` had no slot
   for the SHA — serde silently dropped it on every round-trip.
   Splitting `ref` and `branch` makes both pieces of state
   round-trippable. `toolpath-github` was the load-bearing bug: it
   was writing the branch name into `ref` and discarding the SHA.

2. `path validate` now actually validates against
   `schema/toolpath.schema.json`. Previously it only round-tripped
   through the Rust types, so any field with no Rust home (like the
   stale `commit`) was silently accepted. A new integration test
   schema-validates every `examples/*.json` fixture so future drift
   is caught at `cargo test` time.

Public API changes (pre-1.0 = potentially breaking):

- toolpath 0.3.0 → 0.4.0 — `Base.branch: Option<String>` added;
  `with_branch` builder.
- toolpath-github 0.2.1 → 0.3.0 — behavioral: `Base.ref` now reads
  `pr.base.sha`; `Base.branch` reads `pr.base.ref`. Re-derive any
  PR to get the corrected shape.
- toolpath-git 0.2.0 → 0.3.0 — populates `Base.branch` from spec.
- toolpath-codex 0.1.0 → 0.2.0 — populates `Base.branch` from
  `session_meta.git.branch`.
- toolpath-md 0.3.0 → 0.4.0 — renders `branch` alongside `ref`.
- path-cli 0.6.0 → 0.7.0 — new `jsonschema` runtime dep; schema
  validation wired into `path validate`; new `schema_examples`
  integration test.
- toolpath-cli 0.6.0 → 0.7.0 — lockstep shim bump.

Schema:
- `base.branch` added (optional). Only `uri` is required.
- `pathIdentity.base` no longer required (matches Rust
  `Option<Base>` and the RFC's minimal-step example).
- Descriptions softened: `base` is an "origin identifier", not
  strictly a "VCS reference".

Examples:
- The four PR-shaped fixtures and their `.path.jsonl` siblings
  carry their original SHAs in `ref` again with `"main"` moved to
  `branch`. `path-02-local-session.path.json`'s standalone `commit`
  was renamed to `ref`.

Cosmetic:
- `crates/path-cli/src/cmd_query.rs` — "Document has no head step"
  → "Graph has no head step" (the `Document` enum is gone).

Tests: cargo build, cargo test --workspace (1354 passed, 0 failed),
cargo clippy --workspace -- -D warnings all green.