v0.4.2 - dep bumps + UX guardrails for silent zero-result traps

Two strands rolled together:

Renovate dep bumps (auto-merged into main via MR !3):
- catalog v1.6.0 -> v1.7.0 across 7 includes (claude-drift-triage,
  go-audit, go-build, go-release-binary, go-sbom, slsa-attest,
  release-create)
- github.com/BurntSushi/toml v1.3.2 -> v1.6.0
- golang.org/x/sys v0.43.0 -> v0.44.0
- golang.org/x/term v0.42.0 -> v0.43.0

UX guardrails - five Andy-shaped traps fixed:
- Trap A: --source=tagged|liked with empty children/logins now
  errors with exit 2 instead of running the fetch and saving zero.
- Trap B: bairn drift --diff <empty dir> now exits 2 with a
  seeding hint instead of looking like a healthy gate that's
  actually a passthrough.
- Trap C: source-matching images inside system-generated posts
  count toward Result.SystemPostsFiltered; visible in the
  fetch-complete log so operators see what --include-system-posts
  would unlock.
- Trap D: a filtered source (tagged|liked) that walked pages but
  matched nothing now logs an explicit warn with a hint at the
  most likely cause (--max-pages too low).
- Trap E: bairn login displays the email used to authenticate
  when me.Email comes back empty.

Audit triggered by Andrew DeJong's MRs !1+!2 surfacing the
--feed-all default-true / --feed-tagged silent-override trap. The
--source enum that replaced it (v0.4.0) is the same shape of fix
applied estate-wide.