Runs the wizard embed to depth 2 (se-8zp)

[johnnyt]

What this does

The signup_onboarding fixture embeds the signup wizard as a
core.subchart. Until now the child session started, was provably the
right chart, and then sat at its first step forever: a child was started
with no :invoke_handlers at all, so myapp:signup reached a session
that could not answer it. This makes the embed run to depth 2 - the child
answers its own calls, advances through its own steps, ends, and reports
an outcome the parent routes on.

Three things carry that:

1. The interim pin. statifier moves from Hex ~> 2.3 to a git dep
   on riddler/statifier-ex at
   6b4ff697b6db3f8c7378001fa15a7f9f8b901ef6 - the merge of statifier-ex
   PR 251 (st-pvpz) on that repo's main, and the first commit carrying
   Statifier.Session's :inherit_invoke_handlers. 2.3.0 does not have
   it. override: true rides along because a git ref satisfies none of
   the Hex requirements statifier_blocks, statifier_persistence and
   statifier_oban each state on statifier.

   • previous mix.lock entry: {:hex, :statifier, "2.3.0", ...}
     (checksum d72403de50d98676b9ef6a9f8e2987734b0fb8649956809fbb26164f766553d7)
   • new mix.lock entry:
     {:git, "https://github.com/riddler/statifier-ex.git", "6b4ff697b6db3f8c7378001fa15a7f9f8b901ef6", [ref: "6b4ff697b6db3f8c7378001fa15a7f9f8b901ef6"]}
   • exactly one lock line moved; nothing else in mix.lock changed.

   FINAL re-pin after the operator publishes statifier 2.4.0:
   {:statifier, "~> 2.4"}, no override:, lock refreshed,
   @statifier_ref and its test retired. Upstream PR 251 is already
   MERGED, so this PR is non-draft.

2. The session-start seam. This app has no production root-session
   start site: the durable path drives the pure core through
   StatifierPersistence.Driver, and the only place a root
   Statifier.Session is started is session_opts/0 in
   test/statifier_examples/charts/subchart_test.exs. That is the file
   that gains inherit_invoke_handlers: true, and its comment says why
   the option is opt-in upstream rather than a default.

3. The fixture. priv/fixtures/signup_onboarding.json's description
   said "One level deep on purpose" and named the gap as the reason. It
   now describes the depth-2 run it always wanted.

Evidence

Machine-verified by running the code path, not by reading it. Four tests
in SubchartTest, all green in a full mix quality (228/228, 75.6%
coverage, dialyzer clean):

• the child is inside s_blk_su_verify - reachable only by running the
  account step to completion - and its signup datamodel root holds a
  map the step assigned;
• negative control: with inherit_invoke_handlers: false the same
  document leaves the child in s_blk_su_account with signup still
  nil, which is what the fixture did for its whole life before this;
• the child ends on the wizard's own signup.abandoned interrupt and
  reports %{"outcome" => "done"}; the parent takes its on_done slot,
  assigns the outcome to onboarding, reaches s_blk_so_root__root_done
  and halts :done. Read off a subscription's {:halted, :done} rather
  than a poll, so there is no race between the child's end and the
  parent's.

The "past step 1" assertion was swept 200/200 for determinism before
being written as a plain assertion.

No port was touched: this is a mix test verification bead, and no
server was started.

Beat 11

docs/demo-script.md carried no deferred-to-human marker. Beat 11's
caveat lived in its "One level deep, on purpose" paragraph, which this
diff falsifies; it is replaced with the depth-2 paragraph and an explicit
"that is machine-verified" statement naming what the tests drive. That is
the only part of the file touched.

Provenance

• Bead: se-8zp (campaign 024, Lane B uptake, B5).
• Implements the downstream half of statifier-ex st-pvpz,
  Inherits invoke handlers into child sessions statifier-ex#251 (merged).
• Pin recorded per campaign-024 ruling R-e and the se-p22 interim
  pin pattern; the conductor writes the linkage-ledger entry.
• No sibling PR was rebased over; branch cut from origin/main at
  9a1b4ad, no conflicts.
• Written entirely by one worker; no mixed-writer episode.

Prose the depth-2 run falsified (map widening, granted)

Two moduledoc sites still described the engine before
:inherit_invoke_handlers. Both were outside this bead's original file
map; the conductor granted the widening for exactly these two, and they
are corrected in a second, prose-only commit (fd48fd0):

• lib/statifier_examples/charts/subchart.ex - the "Single-level only"
  section. It said a child is started without the parent's
  :invoke_handlers and filed that upstream. It now says the root
  decides, the opt-in descends transitively, and the shipped set staying
  one level deep is an authoring choice - which is what keeps the
  unwritten {:cycle, _} arm honest.
• lib/statifier_examples/signup.ex moduledoc - "deliberately one level
  deep - see ... on st-pvpz", likewise rewritten.

No behaviour, no specs, no other files. Full gate green on the rewritten
head.