taint is tracked per violation: a remedy clears its own violation's taint only

Maintainer decision, formalized and landed by the BRIA-corrigibility second follow-up, correcting the remedy clause of the standing-violations entry above. The first follow-up's rule sent any remedy to the empty taint, so with two standing violations one remedy freed the other's fruits (BRIAFollowup2.Witness.two_violations_one_remedy_old). Now a taint is a set of (violation, component) pairs: a violating act taints its writes with its own identifier, an act reading tainted components taints its writes with every violation read — taint joins at reads — and the remedy of v clears v's taint only, so a component tainted by several violations stays tainted until all are remedied (taintStep2, taint_joins, remedy_clears2, remedy_keeps_others, taintedBy_remedy, still_tainted_after_one_remedy). Old-to-new map: the old rule is the new rule with every violation given one identifier — the act step projects onto the old one and use is the same predicate (old_is_new_with_one_identifier, uses_old_eq_new) — so every earlier taint result holds at one identifier (taint_propagates ↦ taint_propagates2; remedy_clears ↦ remedy_clears2; taint_decides ↦ taint_decides2; observation_taints_all ↦ observation_taints_all2; knowledge_residual ↦ knowledge_residual2; implant_standing ↦ implant_standing2, with disclosure remedying its own influence only, two_influences_one_disclosure), and what the old rule lost is the identity of the violation a remedy addresses. Rejected alternative: the taint set as a set of components with any remedy clearing it (the first follow-up's rule).