Closed messages for a refused component-override descriptor.

Three verification mistakes, a confined-source refusal, and a schema violation previously collapsed to one catalog sentence with no path. Each verification rule now names the descriptor field it broke; the path is the schema-authorized pointer to that field. Rejected hash values, candidate bytes, and the descriptor's filesystem path never cross this boundary: source.name stays the logical document role component-override.json.