fix(citation): make the well-formed reading-part set rite-supplied

I7 (final-review.md, 2026-08-25-colitur-of-phases-3-5): OF Sundays and
solemnities shipped without the Second reading, and the lectionary
data header called the First reading an "Epistle" -- EF vocabulary.
The sole blocker was Validate's own kernel-hardcoded assertion that a
well-formed day's sorted citation parts are exactly [First; Gospel];
Citation.part already carried Second.

Rite.t gains citation_shapes : Citation.part list list, the fourth
EF-shaped kernel misfit (after Preface.t, Mass_formulary.source,
transfer_target's strictly-later contract) and the first fixed rather
than only documented. EF supplies its one shape unchanged; OF supplies
two, [First; Gospel] on a feria/feast/memorial and [First; Second;
Gospel] on a Sunday or solemnity (OLM 1981 Praenotanda n. 66.1 vs
n. 69.1, n. 84(b)/(c), page-image verified against olm-1981.pdf).
Validate's "citations" check now matches against the rite's own
declared shapes rather than a single literal pattern, preserving all
three invariants it always enforced: zero or one complete shape, never
partial; no part outside what the rite declares; no part repeated.

bootstrap_lectionary_of.ml's cite now extracts a Second reading from
Sunday-cycle ini sections only, correctly excluding the one stray
`second` field lectio's snapshot carries on a weekday-cycle section (a
content-verified scraping artifact). The hand-authored Christmas Day
entry gains its own Second reading from the same OLM passage already
cited for its First/Gospel. Regenerated data/of/lectionary.sexp: 771
entries unchanged, citation fields 1542 -> 1725 (+183, all Second
readings), SHA-256 re-pinned, header wording fixed and a new coverage
bullet added. Responsorial Psalm is deliberately still not emitted --
OLM 1981 Praenotanda n. 71 itself lists it apart from the readings
proper as a chant with its own refrain, and the finding driving this
change names only the missing Second reading.

EF output verified byte-identical to the branch start (empty
lib/rites/rite_ef + data/ef diff since v1.0.0, plus a direct binary
comparison of `day`/`readings` for 2026, 1583 and 9999 against a
worktree build of the pre-change commit).

Tests: three new fixtures in test_validate.ml prove the generalisation
holds both directions (a multi-shape rite accepts either of its
declared shapes; a rite that never declared a shape still rejects it).
test_citation_coverage_of.ml's pinned residual grows 41 -> 49, all new
entries the same already-understood chapter-crossing shape.

1 files changed, 14 insertions, 8 deletions

diff --git a/lib/kernel/validate.mli b/lib/kernel/validate.mli
index 385e111..9ad6b59 100644
--- a/lib/kernel/validate.mli
+++ b/lib/kernel/validate.mli
@@ -84,14 +84,20 @@ val failure_to_string : failure -> string
     {!Rite.readings} on every day and is held to neither, so this stays a
     check on rites that HAVE readings rather than a demand that every rite
     have them.
-    - ["citations"]: well-formedness. A day's citation parts, sorted, are
-      exactly [[First; Gospel]]. This single condition carries three
-      invariants at once: zero or two but never one (an Epistle without a
-      Gospel, or the reverse, is a malformed Mass rather than a partial one);
-      no part outside [First]/[Gospel] (the chants -- Psalm, Second, Tract,
-      Alleluia, Sequence -- are deliberately unbuilt, so one appearing is a
-      defect, not a feature arriving early); and no part twice (two Epistles
-      and no Gospel has length two and would pass a bare cardinality test).
+    - ["citations"]: well-formedness. A day's citation parts, sorted, must be
+      either empty or equal ONE of [rite.Rite.citation_shapes] exactly --
+      rite-supplied ({!Rite.t.citation_shapes}'s own doc comment has the
+      full citation and argument for why: EF has one shape, [[First;
+      Gospel]]; the OF has two, that same pair plus [[First; Second;
+      Gospel]] on Sundays/solemnities). This single condition carries three
+      invariants at once: zero, or exactly one of the rite's own complete
+      shapes, never a partial one (an Epistle without a Gospel, or the
+      reverse, is a malformed Mass under any rite's shape list); no part
+      outside what the rite itself declares (EF: the other chants remain
+      deliberately unbuilt, so one appearing is a defect, not a feature
+      arriving early); and no part twice (two Epistles and no Gospel has
+      length two and would pass a bare cardinality test, but matches none of
+      a rite's own declared shapes).
     - ["citations-unresolved"]: coverage. A day resolved NO citations at all,
       i.e. the rite's own lookup chain fell through every one of its steps.
       Deliberately a separate label from ["citations"] above: a coverage gap