Unspaghettit

Two engine fixes found by dogfooding through the MCP. No breaking changes.

Fixed

• A condition-less invariant can no longer make a whole feature vanish. apply_batch's invariant ops accepted an invariant with a description but no condition and wrote it to disk (the standalone tools already required one). On the next cold load the expression normalizer threw and the loader silently dropped the ENTIRE feature: get_feature returned "not found" and it disappeared from list_features with no error, unrecoverable by restart. Closed three ways: the validator rejects a condition-less invariant at write time (so the batch path fails fast), the normalizer tolerates a missing or malformed condition instead of crashing (so an already-poisoned snapshot loads and becomes fixable), and the loader warns to stderr when it skips an unreadable snapshot instead of dropping a file in silence.
• The digest's "Where you can go" no longer duplicates or mislabels navigation. A surface reachable more than one way rendered one bullet per route, and edges whose target did not resolve to a surface rendered as a bare "... to another surface". get_digest's navigation section now collapses every route from a surface to a given destination into one named entry, and drops any edge whose target is not a surface in the feature.