tools: local corpus guard against real ETS projects

Public CI only runs synthetic fixtures, but every regression we have actually
shipped showed up on real projects, which are confidential and cannot reach a
GitHub runner. corpus_check.py runs a local corpus through the full pipeline
(parse, checks, HA YAML, entity suggestions) and diffs the counts against a
recorded baseline.

Only numbers are committed: counts, severity and code histograms, and a short
digest per source file. The project map with real paths lives in
tools/corpus_map.json, which is gitignored; corpus_map.example.json shows the
shape. Verified both directions: a deliberate change to the diagnostics filter
made the guard exit 1 and name the two metrics that moved, a clean tree exits 0,
and a machine without a map exits 2 without doing anything.

Wired into CONTRIBUTING and into the release checklist before the build step.

tools/corpus_map.example.json

@@ -0,0 +1,17 @@
+{
+  "_comment": "Copy to corpus_map.json and point each path at a real .knxproj. corpus_map.json is gitignored: paths and client names never enter the repo. Labels are what the baseline stores, so keep them neutral.",
+  "projects": [
+    {
+      "label": "vendor-a-large",
+      "path": "some-folder/big-project.knxproj"
+    },
+    {
+      "label": "vendor-b-flat",
+      "path": "some-folder/flat.knxproj"
+    },
+    {
+      "label": "demo",
+      "path": "demo-home/demo-home.knxproj"
+    }
+  ]
+}