feat(server): INGEST_WING_RESOLVE=1 wires the wing resolver into the watcher (#205 S3)

Off by default (retired layout unchanged). On: eligibility from
classification.yaml, local ingest LLM as classifier, BM25 as cross-check,
INGEST_WING_THRESHOLD (default 0.9, rejected outside [0,1]). Build failure
is fatal when explicitly enabled.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

ingestion/internal/wing/configured_test.go

@@ -0,0 +1,47 @@
+package wing_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/mathiasbq/hyperguild/ingestion/internal/wing"
+)
+
+func configuredBrain(t *testing.T, classification string) string {
+	dir := t.TempDir()
+	writePage(t, dir, "wiki/homelab/facts/a.md", "x")
+	writePage(t, dir, "wiki/radar/facts/b.md", "x")
+	writePage(t, dir, "wiki/client-x/facts/c.md", "x")
+	if classification != "" {
+		writePage(t, dir, "classification.yaml", classification)
+	}
+	return dir
+}
+
+func TestNewConfiguredResolver_EligibilityComesFromClassification(t *testing.T) {
+	dir := configuredBrain(t, "wings:\n  radar: internal\n")
+	r, err := wing.NewConfiguredResolver(dir, func(context.Context, string, string) (string, error) { return "", nil }, 0.9)
+	require.NoError(t, err)
+
+	assert.ElementsMatch(t, []string{"client-x", "homelab", "radar"}, r.Known)
+	assert.True(t, r.Eligible("radar"), "tagged internal")
+	assert.True(t, r.Eligible("homelab"), "internal by built-in default")
+	assert.False(t, r.Eligible("client-x"), "an untagged wing fails safe to confidential")
+	assert.InDelta(t, 0.9, r.Threshold, 1e-9)
+}
+
+func TestNewConfiguredResolver_AMalformedClassificationFileIsAnError(t *testing.T) {
+	dir := configuredBrain(t, "wings: [not, a, map")
+	_, err := wing.NewConfiguredResolver(dir, nil, 0.9)
+	assert.Error(t, err, "a classification source that cannot be trusted must not degrade to 'everything eligible'")
+}
+
+func TestNewConfiguredResolver_AConfidentialTagIsNeverEligible(t *testing.T) {
+	dir := configuredBrain(t, "wings:\n  radar: confidential\n")
+	r, err := wing.NewConfiguredResolver(dir, nil, 0.9)
+	require.NoError(t, err)
+	assert.False(t, r.Eligible("radar"))
+}