fix: cs/cf single-sub passthrough bypasses Group, Fate, and Versus rejections #109

[edloidas]

Closed three CRITICAL bypasses introduced by #97's single-sub-roll Group passthrough. All three shared one root cause: shallow reject helpers vs. the deep containsDicePool/deepContainsDicePool walk that the Group passthrough now relies on.

• Added containsMultiSubGroup deep-walk to ast.ts; rejectGroupTarget uses it on the single sub-expression so a multi-sub Group buried under arithmetic, function calls, or unary ops re-rejects ({{1d20, 1d20}kh1}cs>18, {abs({1d6, 2d8})}cs>5, {-{1d6, 2d8}}cs>5, {floor({1d6, 2d8}/1)}cs>5).
• Added deepContainsFatePool mirroring deepContainsDicePool; containsFatePool's Group case switches to it so {4dF+1d6}cf, ({4dF+1d6})cf, and {abs(4dF)}cf no longer flip Fate +1 faces to fumble: true.
• Added containsVersus deep-walk; rejectVersusTarget uses it against Group([single])'s inner expression so Versus buried under arithmetic/function-call rejects with NESTED_VERSUS ({1d20 vs 15}cs>18, {1+(1d20 vs 15)}cs>18, {abs(1d20 vs 15)}cs>18, {1d20 vs 15}s, 4d6>={1d20 vs 15}).
• Added the missing rejectVersusTarget call to parseModifier so {1d20 vs 15}kh1 rejects — closes a pre-existing inconsistency where the parens form rejected with INVALID_MODIFIER_TARGET while the brace form silently dropped degree/natural.
• Strengthened the evaluator round-trip test: asserts result.expression === '{1d20}kh1cs>18' (preserves user notation) and tightened the MockRNG sequence to one value (was four — three were dead weight).
• Added evaluator coverage for the four flipped-accept tests from fix: cs/cf on modifier-wrapped group flags dropped sub-roll dice #97 ({1d6}cs>5, ({1d6})cs>5, {1d6}cf<2, {1d6}kh1cf<2).
• {1d20 vs 15}+5 continues to ACCEPT — BinaryOp uses mergeContext and propagates degree/natural correctly. Explicitly tested.
• Updated STAGE3.md group edge-cases list and CHANGELOG.md [Unreleased] with three Fixed entries.

Closes #109

_{Drafted with AI assistance}